# Possible Denial of Service Vulnerability in Rack Header Parsing

**URL:** <https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942>\
**Category:** Security Announcements\
**Tags:** announcement, rack\
**Created:** [February 21, 2024, 8:32pm UTC](https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942 "2024-02-21T20:32:24Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![tenderlove](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/tenderlove/32/3541_2.png) [@tenderlove](https://discuss.rubyonrails.org/u/tenderlove)\
**Post date:** [February 21, 2024, 8:32pm UTC](https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942/1 "2024-02-21T20:32:24Z")

</div>

There is a possible denial of service vulnerability in the header parsing routines in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26146.

Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.4, 2.1.4.4, 2.2.8.1, 3.0.9.1

## Impact

Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted.

Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected.

## Releases

The fixed releases are available at the normal locations.

## Workarounds

There are no feasible workarounds for this issue.

## Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

- 2-0-header-redos.patch - Patch for 2.0 series
- 2-1-header-redos.patch - Patch for 2.1 series
- 2-2-header-redos.patch - Patch for 2.2 series
- 3-0-header-redos.patch - Patch for 3.0 series

## Credits

Thanks to [svalkanov](https://github.com/svalkanov) for reporting this and providing patches!

[2-0-header-redos.patch](https://discuss.rubyonrails.org/uploads/short-url/sHpVdOeeOaR26vR4Jxr3m9F1eVp.patch) (906 Bytes) [2-1-header-redos.patch](https://discuss.rubyonrails.org/uploads/short-url/rwvIYcVh7k8POPdDyqM4R89jroJ.patch) (922 Bytes) [2-2-header-redos.patch](https://discuss.rubyonrails.org/uploads/short-url/yMUj3p7m9rgDg0klZB01rzZTAQr.patch) (890 Bytes) [3-0-header-redos.patch](https://discuss.rubyonrails.org/uploads/short-url/heYW95L3CGWYV2G5owG9LSYaCIm.patch) (1.5 KB)