Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

rack

50 known vulnerabilities (12 high, 21 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
50 · 12 high, 21 medium, 1 low
Registry
RubyGems

Advisories 50

  • CVE-2026-26962Medium 4.8

    Rack: Header injection in multipart requests

    Affected: from 3.2.0, fixed in 3.2.6.

  • CVE-2026-34835Medium 4.8

    Rack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass.

    Affected: from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6.

  • Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser

    Affected: from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6.

  • CVE-2026-32762Medium 4.8

    Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing

    Affected: from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6.

  • CVE-2026-34830Medium 5.9

    Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginx

    Affected: fixed in 2.2.23; from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6.

  • Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length

    Affected: fixed in 2.2.23; from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6.

  • CVE-2026-34826Medium 5.3

    Rack: Unbounded Range Count in get_byte_ranges Enables DoS

    Affected: fixed in 2.2.23; from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6.

  • CVE-2026-34786Medium 5.3

    Rack: Rack::Static header_rules bypass via URL-encoded paths

    Affected: fixed in 2.2.23; from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6.

  • Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching

    Affected: fixed in 2.2.23; from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6.

  • CVE-2026-34763Medium 5.3

    Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation

    Affected: fixed in 2.2.23; from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6.

  • CVE-2026-34831Medium 4.8

    Rack: Content-Length mismatch in Rack::Files error responses

    Affected: fixed in 2.2.23; from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6.

  • Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypass

    Affected: fixed in 2.2.23; from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6.

  • CVE-2026-34230Medium 5.3

    Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header

    Affected: fixed in 2.2.23; from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6.

  • CVE-2026-25500Medium 5.4

    Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href

    Affected: fixed in 2.2.22; from 3.0.0.beta1, fixed in 3.1.20; from 3.2.0, fixed in 3.2.5.

  • Rack has a Directory Traversal via Rack:Directory

    Affected: fixed in 2.2.22; from 3.0.0.beta1, fixed in 3.1.20; from 3.2.0, fixed in 3.2.5.

Show all 50 advisoriesShow fewer advisories

  • Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing

    Affected: fixed in 2.2.20; from 3.0, fixed in 3.1.18; from 3.2, fixed in 3.2.3.

  • CVE-2025-61780Medium 5.8

    Rack has Possible Information Disclosure Vulnerability

    Affected: fixed in 2.2.20; from 3.0, fixed in 3.1.18; from 3.2, fixed in 3.2.3.

  • Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

    Affected: fixed in 2.2.19; from 3.1, fixed in 3.1.17; from 3.2, fixed in 3.2.2.

  • Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

    Affected: fixed in 2.2.19; from 3.1, fixed in 3.1.17; from 3.2, fixed in 3.2.2.

  • Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)

    Affected: fixed in 2.2.19; from 3.1, fixed in 3.1.17; from 3.2, fixed in 3.2.2.

  • Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters

    Affected: fixed in 2.2.18.

  • CVE-2025-49007Medium 6.6

    ReDoS Vulnerability in Rack::Multipart handle_mime_head

    Affected: from 3.1.0, fixed in 3.1.16.

  • Unbounded-Parameter DoS in Rack::QueryParser

    Affected: fixed in 2.2.14; from 3.0, fixed in 3.0.16; from 3.1, fixed in 3.1.14.

  • CVE-2025-32441Medium 4.2

    Rack session gets restored after deletion

    Affected: fixed in 2.2.14.

  • Local File Inclusion in Rack::Static

    Affected: fixed in 2.2.13; from 3.0, fixed in 3.0.14; from 3.1, fixed in 3.1.12.

  • CVE-2025-27111Medium 6.9

    Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

    Affected: fixed in 2.2.12; from 3.0, fixed in 3.0.13; from 3.1, fixed in 3.1.11.

  • CVE-2025-25184Medium 5.7

    Possible Log Injection in Rack::CommonLogger

    Affected: fixed in 2.2.11; from 3.0, fixed in 3.0.12; from 3.1, fixed in 3.1.10.

  • CVE-2023-27539Medium 5.3

    There is a denial of service vulnerability in the header parsing component of Rack.

    Affected: from 2.0.0, fixed in 2.2.6.4; from 3.0.0, fixed in 3.0.6.1.

  • CVE-2024-39316Medium 6.5

    Rack ReDoS Vulnerability in HTTP Accept Headers Parsing

    Affected: from 3.1.0, fixed in 3.1.5.

  • CVE-2024-26141Medium 5.8

    Possible DoS Vulnerability with Range Header in Rack

    Affected: from 3.0.0, fixed in 3.0.9.1; from 1.3.0, fixed in 2.2.8.1.

  • CVE-2024-25126Medium 5.3

    Rack ReDos in content type parsing (2nd degree polynomial)

    Affected: from 3.0.0, fixed in 3.0.9.1; from 0.4, fixed in 2.2.8.1.

  • CVE-2024-26146Medium 5.3

    Possible Denial of Service Vulnerability in Rack Header Parsing

    Affected: from 3.0.0, fixed in 3.0.9.1; from 2.2.0, fixed in 2.2.8.1; from 2.1.0, fixed in 2.1.4.4; fixed in 2.0.9.4.

  • A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could…

    Affected: fixed in 2.0.9.3; from 2.1.0, fixed in 2.1.4.3; from 2.2.0, fixed in 2.2.6.3; from 3.0.0, fixed in 3.0.4.2.

  • A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an…

    Affected: from 2.0.0, fixed in 2.0.9.2; from 2.1.0.0, fixed in 2.1.4.2; from 2.2.0.0, fixed in 2.2.6.1; from 3.0.0.0, fixed in 3.0.4.1.

  • There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1.

    Affected: from 2.0.0, fixed in 2.0.9.2; from 2.1.0, fixed in 2.1.4.2; from 2.2.0, fixed in 2.2.6.1; from 3.0.0.0, fixed in 3.0.4.1.

  • A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0.

    Affected: from 1.5.0, fixed in 2.0.9.2; from 2.1.0.0, fixed in 2.1.4.2; from 2.2.0.0, fixed in 2.2.6.2; from 3.0.0.0, fixed in 3.0.4.1.

  • A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint…

    Affected: fixed in 2.0.9.1; from 2.1, fixed in 2.1.4.1; from 2.2, fixed in 2.2.3.1.

  • A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.

    Affected: from 1.2, fixed in 2.0.9.1; from 2.1, fixed in 2.1.4.1; from 2.2, fixed in 2.2.3.1.

  • A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the…

    Affected: fixed in 2.1.3.

  • A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is…

    Affected: fixed in 2.1.4; from 2.2.0, fixed in 2.2.3.

  • CVE-2019-16782Medium 6.3

    Possible Information Leak / Session Hijack Vulnerability in Rack

    Affected: fixed in 1.6.12; from 2.0.0, fixed in 2.0.8.

  • There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11.

    Affected: from 2.0.0, fixed in 2.0.6; fixed in 1.6.11.

  • There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6.

    Affected: from 2.0.4, fixed in 2.0.6.

  • lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote…

    Affected: from 1.5.0, fixed in 1.5.4; from 1.6.0, fixed in 1.6.2; from 1.4.0, fixed in 1.4.6.

  • Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x…

    Affected: from 1.1.0, fixed in 1.1.5; from 1.2.0, fixed in 1.2.7; from 1.3.0, fixed in 1.3.9; from 1.4.0, fixed in 1.4.4.

  • multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory…

    Affected: from 1.3.0, fixed in 1.3.8; from 1.4.0, fixed in 1.4.3.

  • lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular…

    Affected: fixed in 1.1.4; from 1.2.0, fixed in 1.2.6; from 1.3.0, fixed in 1.3.7; from 1.4.0, fixed in 1.4.2.

  • Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6…

    Affected: from 1.5.0, fixed in 1.5.2; from 1.4.0, fixed in 1.4.5; from 1.3.0, fixed in 1.3.10; from 1.2.0, fixed in 1.2.8; from 1.1.0, fixed in 1.1.6.

  • rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the…

    Affected: from 1.5.0, fixed in 1.5.2; from 1.4.0, fixed in 1.4.5.

  • Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to…

    Affected: fixed in 1.1.3; from 1.2.0, fixed in 1.2.5; from 1.3.0, fixed in 1.3.6.