# Possible DoS Vulnerability with Range Header in Rack

**URL:** <https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944>\
**Category:** Security Announcements\
**Tags:** announcement, rack\
**Created:** [February 21, 2024, 8:37pm UTC](https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944 "2024-02-21T20:37:01Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![tenderlove](https://sea2.discourse-cdn.com/rubyonrails/user_avatar/discuss.rubyonrails.org/tenderlove/32/3541_2.png) [@tenderlove](https://discuss.rubyonrails.org/u/tenderlove)\
**Post date:** [February 21, 2024, 8:37pm UTC](https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944/1 "2024-02-21T20:37:01Z")

</div>

There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141.

Versions Affected: \>= 1.3.0. Not affected: \< 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1

## Impact

Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue.

Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications).

## Releases

The fixed releases are available at the normal locations.

## Workarounds

There are no feasible workarounds for this issue.

## Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

- 3-0-range.patch - Patch for 3.0 series
- 2-2-range.patch - Patch for 2.2 series

## Credits

Thank you [ooooooo\_q](https://hackerone.com/ooooooo_q) for the report and patch

[2-2-range.patch](https://discuss.rubyonrails.org/uploads/short-url/lQjLaFuxl2weKovlsJZptrXfIyB.patch) (1.4 KB) [3-0-range.patch](https://discuss.rubyonrails.org/uploads/short-url/w4O27JgYroyWwEBnnrMjIteFeB1.patch) (1.3 KB)