Ruby Rack versions prior to 2.2.23, 3.1.21, and 3.2.6 contain a vulnerability in the Rack::Utils.get_byte_ranges method, which parses the HTTP Range header without limiting the count of individual byte ranges. Although a previous fix for CVE-2024-26141 addressed total byte coverage exceeding file size, it did not restrict the number of ranges. An attacker can exploit this by sending many small overlapping byte ranges (e.g., 0-0,0-0,0-0,...) to trigger excessive CPU, memory, I/O, and bandwidth consumption per request. This results in a denial of service condition in Rack file-serving paths that handle multipart byte range responses. The vulnerability is fixed in versions 2.2.23, 3.1.21, and 3.2.6.

Exploitation of this vulnerability can cause denial of service by overwhelming server resources such as CPU, memory, I/O, and bandwidth when processing multipart byte range responses. There is no impact on confidentiality or integrity. The denial of service affects availability of services relying on vulnerable Rack versions.

This vulnerability has been patched in Ruby Rack versions 2.2.23, 3.1.21, and 3.2.6. Users should upgrade to these or later versions to remediate the issue. Patch status is confirmed by the vendor advisory. No additional mitigations are specified.