The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2113 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126)

    * rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141)

    * rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2581 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126)

    * rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141)

    * rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s)     listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-eae2126736 advisory.

    Update to Rack 2.2.21

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0765-1 advisory.

    - CVE-2024-25126: Fixed a denial-of-service vulnerability in Rack Content-Type parsing (bsc#1220239).
    - CVE-2024-26141: Fixed a denial-of-service vulnerability in Range request header parsing (bsc#1220242).
    - CVE-2024-26146: Fixed a denial-of-service vulnerability in Rack headers parsing routine (bsc#1220248).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6689-1 advisory.

    It was discovered that Rack incorrectly parse some headers. An attacker could possibly use this issue to     cause a denial of service. (CVE-2023-27539, CVE-2024-26141, CVE-2024-26146)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of pcs installed on the remote host is prior to 0.9.169-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2492 advisory.

    A Denial of Service (DoS) vulnerability was found in rubygem-rack in how it parses Content-Type. Carefully     crafted content type headers can cause Rack's media type parser to take much longer than expected, leading     to a possible denial of service vulnerability. (CVE-2024-25126)

    A Denial of Service (DoS) vulnerability was found in rubygem-rack in how it parses Range Header. Carefully     crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with     such large responses could lead to a denial of service issue. (CVE-2024-26141)

    A Denial of Service (DoS) vulnerability was found in rubygem-rack in how it parses Rack Header. Carefully     crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible     denial of service issue. Accept and Forwarded headers are impacted. (CVE-2024-26146)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1841 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126)

    * rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141)

    * rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2953 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126)

    * rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141)

    * rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3431 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126)

    * rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141)

    * rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2953 advisory.

    - Fixed CVE-2024-25126, CVE-2024-26141, CVE-2024-26146 in bundled dependency rack       Resolves: RHEL-26445, RHEL-26447, RHEL-26449

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 23.10 / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6837-1 advisory.

    It was discovered that Rack incorrectly handled Multipart MIME parsing. A remote attacker could possibly     use this issue to cause Rack to consume resources, leading to a denial of service. This issue only     affected Ubuntu 23.10. (CVE-2023-27530)

    It was discovered that Rack incorrectly parsed certain media types. A remote attacker could possibly use     this issue to cause Rack to consume resources, leading to a denial of service. (CVE-2024-25126)

    It was discovered that Rack incorrectly handled certain Range headers. A remote attacker could possibly     use this issue to cause Rack to create large responses, leading to a denial of service. This issue only     affected Ubuntu 24.04 LTS. (CVE-2024-26141)

    It was discovered that Rack incorrectly handled certain crafted headers. A remote attacker could possibly     use this issue to cause Rack to consume resources, leading to a denial of service. This issue only     affected Ubuntu 24.04 LTS. (CVE-2024-26146)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2113 advisory.

    - Fixed CVE-2024-25126, CVE-2024-26141, CVE-2024-26146 in bundled dependency rack       Resolves: RHEL-26446, RHEL-26448, RHEL-26450

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8111:01 advisory.

    * rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126)
      * rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141)
      * rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0280 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-25126:
    Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond     with an unexpectedly large response. Responding with such large responses could lead to a denial of     service issue. Vulnerable applications will use the `Rack::File` middleware or the     `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in     3.0.9.1 and 2.2.8.1.

    CVE-2024-26141:
    A denial of service (DoS) vulnerability was found in rubygem-rack in how it parses Content-Type. Carefully     crafted content type headers can cause Racks media type parser to take much longer than expected,     leading to a possible denial of service vulnerability.

    CVE-2024-26146:
    Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to     take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers     are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are     unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2024_2953 advisory.

    * rubygem-rack: Denial of Service Vulnerability in Rack Content-Type Parsing (CVE-2024-25126)

    * rubygem-rack: Possible DoS Vulnerability with Range Header in Rack (CVE-2024-26141)

    * rubygem-rack: Possible Denial of Service Vulnerability in Rack Header Parsing (CVE-2024-26146)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1790610419 advisory.

  - Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack's media     type parser to take much longer than expected, leading to a possible denial of service vulnerability     (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1. (CVE-2024-25126)

  - Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond     with an unexpectedly large response. Responding with such large responses could lead to a denial of     service issue. Vulnerable applications will use the `Rack::File` middleware or the     `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in     3.0.9.1 and 2.2.8.1. (CVE-2024-26141)

  - Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to     take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers     are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are     unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1. (CVE-2024-26146)

  - Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its     params_limit only for parameters separated by &, while still splitting on both & and ;. As a result,     attackers could use ; separators to bypass the parameter count limit and submit more parameters than     intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration     (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a     limited denial-of-service vector. This issue has been patched in version 2.2.18. (CVE-2025-59830)

  - Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2,     `Rack::Multipart::Parser` buffers the entire multipart preamble (bytes before the first boundary) in     memory without any size limit. A client can send a large preamble followed by a valid boundary, causing     significant memory use and potential process termination due to out-of-memory (OOM) conditions. Remote     attackers can trigger large transient memory spikes by including a long preamble in multipart/form-data     requests. The impact scales with allowed request sizes and concurrency, potentially causing worker crashes     or severe slowdown due to garbage collection. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a preamble size     limit (e.g., 16 KiB) or discard preamble data entirely. Workarounds include limiting total request body     size at the proxy or web server level and monitoring memory and set per-process limits to prevent OOM     conditions. (CVE-2025-61770)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2025-203b7db566 advisory.

    https://fedoraproject.org/wiki/Changes/Ruby_on_Rails_8.0

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
194801	RHEL 9 : pcs (RHSA-2024:2113)	Nessus	Red Hat Local Security Checks	2024/4/30	2025/3/14	high
194845	RHEL 8 : pcs (RHSA-2024:2581)	Nessus	Red Hat Local Security Checks	2024/4/30	2025/2/17	high
275253	Fedora 42 : rubygem-rack (2025-eae2126736)	Nessus	Fedora Local Security Checks	2025/11/12	2025/11/12	high
191622	SUSE SLES15: ruby2.5-rubygem-rack / ruby2.5-rubygem-rack-doc / etc (SUSE-SU-2024:0765-1)	Nessus	SuSE Local Security Checks	2024/3/6	2026/6/25	high
191925	Ubuntu 23.10 : Rack vulnerabilities (USN-6689-1)	Nessus	Ubuntu Local Security Checks	2024/3/12	2025/2/17	high
192209	Amazon Linux 2 : pcs (ALAS-2024-2492)	Nessus	Amazon Linux Local Security Checks	2024/3/18	2025/2/17	high
193416	RHEL 9 : pcs (RHSA-2024:1841)	Nessus	Red Hat Local Security Checks	2024/4/17	2025/2/17	high
197763	RHEL 8 : pcs (RHSA-2024:2953)	Nessus	Red Hat Local Security Checks	2024/5/23	2025/2/17	high
197979	RHEL 8 : pcs (RHSA-2024:3431)	Nessus	Red Hat Local Security Checks	2024/5/28	2025/2/17	high
198015	Oracle Linux 8 : pcs (ELSA-2024-2953)	Nessus	Oracle Linux Local Security Checks	2024/5/28	2025/9/9	high
200667	Ubuntu 23.10 / 24.04 LTS : Rack vulnerabilities (USN-6837-1)	Nessus	Ubuntu Local Security Checks	2024/6/17	2025/9/3	high
195026	Oracle Linux 9 : pcs (ELSA-2024-2113)	Nessus	Oracle Linux Local Security Checks	2024/5/6	2025/9/9	high
291925	MiracleLinux 9 : pcs-0.11.7-2.el9_4.ML.1 (AXSA:2024-8111:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
276139	TencentOS Server 4: pcs (TSSA-2024:0280)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	high
355263	Rocky Linux 8 [CIQ] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (crlsa-2024_2953)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	high
359770	CentOS Linux 8.5 [TuxCare] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1790610419)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	high
242193	Fedora 43 : rubygem-actioncable / rubygem-actionmailbox / rubygem-actionmailer / etc (2025-203b7db566)	Nessus	Fedora Local Security Checks	2025/7/16	2025/7/16	medium

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium