Is CVE-2024-26141 in the CISA KEV catalog?

No. CVE-2024-26141 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2024-26141?

CVE-2024-26141 has a CVSS v3 base score of 5.8 (MEDIUM).

What is the EPSS score for CVE-2024-26141?

CVE-2024-26141 has an EPSS score of 1.61% (73th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2024-26141?

Upgrade ruby-rack on debian 11 to 2.1.4-3+deb11u2 or later. Fixes are available for 94 affected products.

CVE & CISA-KEV Catalog

CVE-2024-26141

MEDIUMEPSS 73th pctl

5.8

CVSS v3

NVD

Description

Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.

CWE-400Resource Exhaustion

How to fix

Remediation Available

ruby-rackDebian

Fixed in:2.1.4-3+deb11u2CVE-2024-26141

Fixed in:2.2.6.4-1+deb12u1CVE-2024-26141

Fixed in:2.2.7-1.1CVE-2024-26141

foremanRed Hat / RHEL

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foremanRocky

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-cliRed Hat / RHEL

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-cliRocky

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-debugRocky

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-debugRed Hat / RHEL

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-dynflow-sidekiqRocky

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-dynflow-sidekiqRed Hat / RHEL

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-ec2Rocky

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-ec2Red Hat / RHEL

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-fapolicydRocky

Fixed in:0:1.0.1-3.el8satRHSA-2024:10806

foreman-fapolicydRed Hat / RHEL

Fixed in:0:1.0.1-3.el8satRHSA-2024:10806

foreman-installerRed Hat / RHEL

Fixed in:1:3.9.3.7-1.el8satRHSA-2024:10806

foreman-installerRocky

Fixed in:1:3.9.3.7-1.el8satRHSA-2024:10806

foreman-installer-katelloRocky

Fixed in:1:3.9.3.7-1.el8satRHSA-2024:10806

foreman-installer-katelloRed Hat / RHEL

Fixed in:1:3.9.3.7-1.el8satRHSA-2024:10806

foreman-journaldRed Hat / RHEL

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-journaldRocky

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-libvirtRed Hat / RHEL

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-libvirtRocky

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-openstackRocky

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-openstackRed Hat / RHEL

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-ovirtRed Hat / RHEL

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-ovirtRocky

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-pcpRocky

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-pcpRed Hat / RHEL

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-postgresqlRed Hat / RHEL

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-postgresqlRocky

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-proxy-fapolicydRocky

Fixed in:0:1.0.1-3.el8satRHSA-2024:10806

foreman-proxy-fapolicydRed Hat / RHEL

Fixed in:0:1.0.1-3.el8satRHSA-2024:10806

foreman-redisRed Hat / RHEL

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-redisRocky

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-serviceRocky

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-serviceRed Hat / RHEL

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-telemetryRed Hat / RHEL

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-telemetryRocky

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-vmwareRocky

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

foreman-vmwareRed Hat / RHEL

Fixed in:0:3.9.1.12-1.el8satRHSA-2024:10806

pcsRocky

Fixed in:0:0.10.12-6.el8_6.5RHSA-2024:3431

Fixed in:0:0.10.15-4.el8_8.2RHSA-2024:2581

Fixed in:0:0.10.4-6.el8_2.5RHSA-2024:2007

Fixed in:0:0.10.8-1.el8_4.5RHSA-2024:2584

Fixed in:0:0.10.12-6.el8_6.5RHSA-2024:3431

Fixed in:0:0.10.18-2.el8_10RHSA-2024:2953

Fixed in:0:0.11.4-7.el9_2.1RHSA-2024:1846

Fixed in:0:0.11.7-2.el9_4RHSA-2024:2113

Fixed in:0:0.11.4-7.el9_2.1RHSA-2024:1846

Fixed in:0:0.11.7-2.el9_4RHSA-2024:2113

Fixed in:0:0.11.1-10.el9_0.5RHSA-2024:1841

Fixed in:0:0.11.7-2.el9_4RHSA-2024:2113

Fixed in:0:0.11.1-10.el9_0.5RHSA-2024:1841

Fixed in:0:0.11.7-2.el9_4RHSA-2024:2113

Fixed in:0:0.11.1-10.el9_0.5RHSA-2024:1841

Fixed in:0:0.11.4-7.el9_2.1RHSA-2024:1846

Fixed in:0:0.11.1-10.el9_0.5RHSA-2024:1841

pcsRed Hat / RHEL

Fixed in:0:0.10.15-4.el8_8.2RHSA-2024:2581

Fixed in:0:0.10.4-6.el8_2.5RHSA-2024:2007

Fixed in:0:0.10.8-1.el8_4.5RHSA-2024:2584

Fixed in:0:0.10.12-6.el8_6.5RHSA-2024:3431

Fixed in:0:0.10.15-4.el8_8.2RHSA-2024:2581

Fixed in:0:0.10.18-2.el8_10RHSA-2024:2953

Fixed in:0:0.11.7-2.el9_4RHSA-2024:2113

Fixed in:0:0.11.4-7.el9_2.1RHSA-2024:1846

Fixed in:0:0.11.7-2.el9_4RHSA-2024:2113

Fixed in:0:0.11.1-10.el9_0.5RHSA-2024:1841

Fixed in:0:0.11.4-7.el9_2.1RHSA-2024:1846

Fixed in:0:0.11.7-2.el9_4RHSA-2024:2113

Fixed in:0:0.11.4-7.el9_2.1RHSA-2024:1846

pcs-snmpRed Hat / RHEL

Fixed in:0:0.10.8-1.el8_4.5RHSA-2024:2584

Fixed in:0:0.10.15-4.el8_8.2RHSA-2024:2581

Fixed in:0:0.10.18-2.el8_10RHSA-2024:2953

Fixed in:0:0.10.15-4.el8_8.2RHSA-2024:2581

Fixed in:0:0.10.12-6.el8_6.5RHSA-2024:3431

Fixed in:0:0.10.4-6.el8_2.5RHSA-2024:2007

Fixed in:0:0.10.8-1.el8_4.5RHSA-2024:2584

Fixed in:0:0.11.7-2.el9_4RHSA-2024:2113

Fixed in:0:0.11.4-7.el9_2.1RHSA-2024:1846

Fixed in:0:0.11.1-10.el9_0.5RHSA-2024:1841

Fixed in:0:0.11.7-2.el9_4RHSA-2024:2113

Fixed in:0:0.11.4-7.el9_2.1RHSA-2024:1846

Fixed in:0:0.11.7-2.el9_4RHSA-2024:2113

Fixed in:0:0.11.4-7.el9_2.1RHSA-2024:1846

Fixed in:0:0.11.1-10.el9_0.5RHSA-2024:1841

pcs-snmpRocky

Fixed in:0:0.10.8-1.el8_4.5RHSA-2024:2584

Fixed in:0:0.10.18-2.el8_10RHSA-2024:2953

Fixed in:0:0.10.12-6.el8_6.5RHSA-2024:3431

Fixed in:0:0.10.15-4.el8_8.2RHSA-2024:2581

Fixed in:0:0.10.4-6.el8_2.5RHSA-2024:2007

Fixed in:0:0.10.8-1.el8_4.5RHSA-2024:2584

Fixed in:0:0.11.1-10.el9_0.5RHSA-2024:1841

Fixed in:0:0.11.7-2.el9_4RHSA-2024:2113

Fixed in:0:0.11.4-7.el9_2.1RHSA-2024:1846

Fixed in:0:0.11.7-2.el9_4RHSA-2024:2113

Fixed in:0:0.11.1-10.el9_0.5RHSA-2024:1841

Fixed in:0:0.11.7-2.el9_4RHSA-2024:2113

Fixed in:0:0.11.4-7.el9_2.1RHSA-2024:1846

Fixed in:0:0.11.1-10.el9_0.5RHSA-2024:1841

Fixed in:0:0.11.4-7.el9_2.1RHSA-2024:1846

Fixed in:0:0.11.7-2.el9_4RHSA-2024:2113

pulpcore-obsolete-packagesRed Hat / RHEL

Fixed in:0:1.0-10.el8pcRHSA-2024:10806

pulpcore-obsolete-packagesRocky

Fixed in:0:1.0-10.el8pcRHSA-2024:10806

puppetserverRed Hat / RHEL

Fixed in:0:7.17.2-1.el8satRHSA-2024:10806

puppetserverRocky

Fixed in:0:7.17.2-1.el8satRHSA-2024:10806

python-pulp-containerRed Hat / RHEL

Fixed in:0:2.16.9-2.el8pcRHSA-2024:10806

python-pulp-containerRocky

Fixed in:0:2.16.9-2.el8pcRHSA-2024:10806

python3.11-pulp-containerRed Hat / RHEL

Fixed in:0:2.16.9-2.el8pcRHSA-2024:10806

python3.11-pulp-containerRocky

Fixed in:0:2.16.9-2.el8pcRHSA-2024:10806

rubygem-actioncableRed Hat / RHEL

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-actioncableRocky

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-actionmailboxRed Hat / RHEL

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-actionmailboxRocky

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-actionmailerRocky

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-actionmailerRed Hat / RHEL

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-actionpackRocky

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-actionpackRed Hat / RHEL

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-actiontextRed Hat / RHEL

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-actiontextRocky

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-actionviewRed Hat / RHEL

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-actionviewRocky

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-activejobRed Hat / RHEL

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-activejobRocky

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-activemodelRed Hat / RHEL

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-activemodelRocky

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-activerecordRed Hat / RHEL

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-activerecordRocky

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-activestorageRocky

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-activestorageRed Hat / RHEL

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-activesupportRed Hat / RHEL

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-activesupportRocky

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-foreman_rh_cloudRed Hat / RHEL

Fixed in:0:9.0.59-1.el8satRHSA-2024:10806

rubygem-foreman_rh_cloudRocky

Fixed in:0:9.0.59-1.el8satRHSA-2024:10806

rubygem-katelloRed Hat / RHEL

Fixed in:0:4.11.0.19-1.el8satRHSA-2024:10806

rubygem-katelloRocky

Fixed in:0:4.11.0.19-1.el8satRHSA-2024:10806

rubygem-rackRed Hat / RHEL

Fixed in:0:2.2.8.1-1.el8satRHSA-2024:10806

rubygem-rackRocky

Fixed in:0:2.2.8.1-1.el8satRHSA-2024:10806

rubygem-railsRocky

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-railsRed Hat / RHEL

Fixed in:0:6.1.7.7-1.el8satRHSA-2024:10806

rubygem-railtiesRocky

Fixed in:0:6.1.7.7-2.el8satRHSA-2024:10806

rubygem-railtiesRed Hat / RHEL

Fixed in:0:6.1.7.7-2.el8satRHSA-2024:10806

rubygem-smart_proxy_ansibleRocky

Fixed in:0:3.5.6-0.1.el8satRHSA-2024:10806

rubygem-smart_proxy_ansibleRed Hat / RHEL

Fixed in:0:3.5.6-0.1.el8satRHSA-2024:10806

satelliteRocky

Fixed in:0:6.15.5-1.el8satRHSA-2024:10806

satelliteRed Hat / RHEL

Fixed in:0:6.15.5-1.el8satRHSA-2024:10806

satellite-capsuleRocky

Fixed in:0:6.15.5-1.el8satRHSA-2024:10806

satellite-capsuleRed Hat / RHEL

Fixed in:0:6.15.5-1.el8satRHSA-2024:10806

satellite-cliRed Hat / RHEL

Fixed in:0:6.15.5-1.el8satRHSA-2024:10806

satellite-cliRocky

Fixed in:0:6.15.5-1.el8satRHSA-2024:10806

satellite-commonRed Hat / RHEL

Fixed in:0:6.15.5-1.el8satRHSA-2024:10806

satellite-commonRocky

Fixed in:0:6.15.5-1.el8satRHSA-2024:10806

ruby-rackUbuntu

Fixed in:1.5.2-3+deb8u3ubuntu1~esm8USN-6837-2

Fixed in:1.6.4-3ubuntu0.2+esm6USN-6837-2

Fixed in:1.6.4-4ubuntu0.2+esm6USN-6837-2

Fixed in:2.0.7-2ubuntu0.1+esm5USN-6837-2

Fixed in:2.1.4-5ubuntu1+esm5USN-6837-2

Fixed in:2.1.4-5ubuntu1.1USN-7036-1

Fixed in:2.2.4-3ubuntu0.2USN-6837-1

Fixed in:2.2.4-3ubuntu0.1USN-6689-1

Fixed in:2.2.7-1ubuntu0.1USN-6837-1

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeChanged

Impact

ConfidentialityNone

IntegrityNone

AvailabilityLow

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Exploit Intelligence

1.61%probability of exploitation in 30 days

73rdpercentile

Elevated risk: more likely to be exploited than 73% of all known CVEs.

References

Patch2

Exploit3

Third-Party Advisory1

security.netapp.com

Mailing List1

lists.debian.org

Related Vulnerabilities

Other CWE-400 (Resource Exhaustion) vulnerabilities, ordered by exploit likelihood. View all

CVE	Severity	CVSS	EPSS	Exploited	Fix
CVE-2023-44487	High	7.5	100%	KEV	Fix
CVE-2021-44228	Critical	10.0	100%	KEV + Ransom	Fix
CVE-2011-3192	High	7.8	99%	-	Fix
CVE-2019-11478	Medium	5.3	95%	-	Fix
CVE-2024-25617	Medium	5.3	89%	-	Fix
CVE-2018-1000115	High	7.5	89%	-	Fix

Embed a live status badge for CVE-2024-26141

Markdown

[![CVE-2024-26141](https://tridentstack.com/cve/badge/CVE-2024-26141.svg)](https://tridentstack.com/cve/CVE-2024-26141)

HTML

<a href="https://tridentstack.com/cve/CVE-2024-26141"><img src="https://tridentstack.com/cve/badge/CVE-2024-26141.svg" alt="CVE-2024-26141"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-02-14.