Last February, CVE-2024-26141 punched a nasty hole in Rack's Range header parsing. All versions since 1.3.0 are exposed. The bug let attackers blow up memory usage and responses—classic denial-of-service—just by crafting bloated Range headers.
The trick? Custom file download handlers. They skip the usual static server guards and let junk headers sneak through. Fixes now depend on validating both the number of ranges and the expected response size.
