BlackTreeCVE Intelligencerack · rack
Official source article: GitHub GHSA-XJ5V-6V4G-JFW6 ↗. Check the applicable product and release in the original source.
Medium technical severity with public exploit material referenced by a structured source; prioritise exposed affected systems while verifying vendor guidance.
Debian, ubuntu findings are scoped to the named distribution, release and source package. An absent finding does not mean a package is unaffected.
A published vendor fix does not prove that a matching update is enabled and installable on a particular asset. Confirm the local package candidate before scheduling remediation.
| Distribution release | Source package | Vendor state | Fixed version | Evidence |
|---|---|---|---|---|
| Debian trixietrixie · source | ruby-rack | Vendor fix publishedDebian records a fixed source-package version for this release. | 2.2.7-1.1 | Debian Security Tracker ↗Source updated 5 Oct 2026 |
| Debian bookwormbookworm · source | ruby-rack | Vendor fix publishedDebian records a fixed source-package version for this release. | 2.2.6.4-1+deb12u1 | Debian Security Tracker ↗Source updated 5 Oct 2026 |
| Debian forkyforky · source | ruby-rack | Vendor fix publishedDebian records a fixed source-package version for this release. | 2.2.7-1.1 | Debian Security Tracker ↗Source updated 5 Oct 2026 |
| Debian sidsid · source | ruby-rack | Vendor fix publishedDebian records a fixed source-package version for this release. | 2.2.7-1.1 | Debian Security Tracker ↗Source updated 5 Oct 2026 |
| Ubuntu 24.04 LTSnoble · standard archive | ruby-rack | Vendor fix publishedCanonical reports that a fixed source package version has been published. Repository candidate availability is not checked by BlackTree. | 2.2.7-1ubuntu0.1 | Canonical Ubuntu Security ↗Source updated 5 Oct 2026 |
These OSV and GitHub advisory ranges apply only to the named package and ecosystem. A listed fixed version is not a universal product patch or proof that an update is installed.
| Ecosystem and package | Affected range | First fixed version | Evidence |
|---|---|---|---|
| RubyGemsrack | ECOSYSTEM: introduced 3.0.0; fixed 3.0.9.1 | 3.0.9.1 | OSV record ↗aggregator derived · 10 Sep 2026 |
| RubyGemsrack | ECOSYSTEM: introduced 1.3.0; fixed 2.2.8.1 | 2.2.8.1 | OSV record ↗aggregator derived · 10 Sep 2026 |
| rubygemsrack | >= 3.0.0, < 3.0.9.1 | 3.0.9.1 | GitHub advisory ↗upstream repository advisory · 18 Mar 2026 |
| rubygemsrack | >= 1.3.0, < 2.2.8.1 | 2.2.8.1 | GitHub advisory ↗upstream repository advisory · 18 Mar 2026 |
Structured product status and remediation from the issuing vendor. Product-state explanations are always visible; large lists can be searched or downloaded.
The vendor explicitly identifies these products as affected by this CVE.
Medium technical severity with public exploit material referenced by a structured source; prioritise exposed affected systems while verifying vendor guidance.
Patch availableRack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.
Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.
The product does not properly control the allocation and maintenance of a limited resource.
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may disrupt the affected service.
Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.
The product does not properly control the allocation and maintenance of a limited resource.
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may disrupt the affected service.
CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.
No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.
A structured CVE source labels at least one public reference as exploit material. BlackTree has not independently validated that it is safe, reliable or weaponised.
CWE-400: Uncontrolled Resource Consumption. The product does not properly control the allocation and maintenance of a limited resource.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:LCommon Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
Operational remediation based on structured source evidence.
Published 28 Feb 2024 · Last source change 13 Feb 2025, 17:41 UTC · CWE-400 · Uncontrolled Resource Consumption
Core structured fields are present and their contributing authorities are shown above.