# rack (RubyGems) vulnerabilities 50 known vulnerabilities (12 high, 21 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://rubygems.org/gems/rack ## Advisories (50) ### [CVE-2026-26962](https://cve.now/CVE-2026-26962): Rack: Header injection in multipart requests - Severity: Medium 4.8 - Published: Apr 2, 2026 - Affected: from 3.2.0, fixed in 3.2.6. ### [CVE-2026-34835](https://cve.now/CVE-2026-34835): Rack: \`Rack::Request\` accepts invalid Host characters, enabling host allowlist bypass. - Severity: Medium 4.8 - Published: Apr 2, 2026 - Affected: from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6. ### [CVE-2026-34827](https://cve.now/CVE-2026-34827): Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser - Severity: High 7.5 - Published: Apr 2, 2026 - Affected: from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6. ### [CVE-2026-32762](https://cve.now/CVE-2026-32762): Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing - Severity: Medium 4.8 - Published: Apr 2, 2026 - Affected: from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6. ### [CVE-2026-34830](https://cve.now/CVE-2026-34830): Rack: Rack::Sendfile regex injection via HTTP\_X\_ACCEL\_MAPPING header allows arbitrary file reads through nginx - Severity: Medium 5.9 - Published: Apr 2, 2026 - Affected: fixed in 2.2.23; from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6. ### [CVE-2026-34829](https://cve.now/CVE-2026-34829): Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length - Severity: High 7.5 - Published: Apr 2, 2026 - Affected: fixed in 2.2.23; from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6. ### [CVE-2026-34826](https://cve.now/CVE-2026-34826): Rack: Unbounded Range Count in get\_byte\_ranges Enables DoS - Severity: Medium 5.3 - Published: Apr 2, 2026 - Affected: fixed in 2.2.23; from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6. ### [CVE-2026-34786](https://cve.now/CVE-2026-34786): Rack: Rack::Static header\_rules bypass via URL-encoded paths - Severity: Medium 5.3 - Published: Apr 2, 2026 - Affected: fixed in 2.2.23; from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6. ### [CVE-2026-34785](https://cve.now/CVE-2026-34785): Rack: Local file inclusion in \`Rack::Static\` via URL Prefix Matching - Severity: High 7.5 - Published: Apr 2, 2026 - Affected: fixed in 2.2.23; from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6. ### [CVE-2026-34763](https://cve.now/CVE-2026-34763): Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation - Severity: Medium 5.3 - Published: Apr 2, 2026 - Affected: fixed in 2.2.23; from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6. ### [CVE-2026-34831](https://cve.now/CVE-2026-34831): Rack: Content-Length mismatch in Rack::Files error responses - Severity: Medium 4.8 - Published: Apr 2, 2026 - Affected: fixed in 2.2.23; from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6. ### [CVE-2026-26961](https://cve.now/CVE-2026-26961): Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypass - Severity: Low 3.7 - Published: Apr 2, 2026 - Affected: fixed in 2.2.23; from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6. ### [CVE-2026-34230](https://cve.now/CVE-2026-34230): Rack: Quadratic complexity in Rack::Utils.select\_best\_encoding via wildcard Accept-Encoding header - Severity: Medium 5.3 - Published: Apr 2, 2026 - Affected: fixed in 2.2.23; from 3.0.0.beta1, fixed in 3.1.21; from 3.2.0, fixed in 3.2.6. ### [CVE-2026-25500](https://cve.now/CVE-2026-25500): Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href - Severity: Medium 5.4 - Published: Feb 18, 2026 - Affected: fixed in 2.2.22; from 3.0.0.beta1, fixed in 3.1.20; from 3.2.0, fixed in 3.2.5. ### [CVE-2026-22860](https://cve.now/CVE-2026-22860): Rack has a Directory Traversal via Rack:Directory - Severity: High 7.5 - Published: Feb 18, 2026 - Affected: fixed in 2.2.22; from 3.0.0.beta1, fixed in 3.1.20; from 3.2.0, fixed in 3.2.5. ### [CVE-2025-61919](https://cve.now/CVE-2025-61919): Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing - Severity: High 7.5 - Published: Oct 10, 2025 - Affected: fixed in 2.2.20; from 3.0, fixed in 3.1.18; from 3.2, fixed in 3.2.3. ### [CVE-2025-61780](https://cve.now/CVE-2025-61780): Rack has Possible Information Disclosure Vulnerability - Severity: Medium 5.8 - Published: Oct 10, 2025 - Affected: fixed in 2.2.20; from 3.0, fixed in 3.1.18; from 3.2, fixed in 3.2.3. ### [CVE-2025-61772](https://cve.now/CVE-2025-61772): Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) - Severity: High 7.5 - Published: Oct 7, 2025 - Affected: fixed in 2.2.19; from 3.1, fixed in 3.1.17; from 3.2, fixed in 3.2.2. ### [CVE-2025-61771](https://cve.now/CVE-2025-61771): Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) - Severity: High 7.5 - Published: Oct 7, 2025 - Affected: fixed in 2.2.19; from 3.1, fixed in 3.1.17; from 3.2, fixed in 3.2.2. ### [CVE-2025-61770](https://cve.now/CVE-2025-61770): Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) - Severity: High 7.5 - Published: Oct 7, 2025 - Affected: fixed in 2.2.19; from 3.1, fixed in 3.1.17; from 3.2, fixed in 3.2.2. ### [CVE-2025-59830](https://cve.now/CVE-2025-59830): Rack QueryParser has an unsafe default allowing params\_limit bypass via semicolon-separated parameters - Severity: High 7.5 - Published: Sep 25, 2025 - Affected: fixed in 2.2.18. ### [CVE-2025-49007](https://cve.now/CVE-2025-49007): ReDoS Vulnerability in Rack::Multipart handle\_mime\_head - Severity: Medium 6.6 - Published: Jun 4, 2025 - Affected: from 3.1.0, fixed in 3.1.16. ### [CVE-2025-46727](https://cve.now/CVE-2025-46727): Unbounded-Parameter DoS in Rack::QueryParser - Severity: High 7.5 - Published: May 7, 2025 - Affected: fixed in 2.2.14; from 3.0, fixed in 3.0.16; from 3.1, fixed in 3.1.14. ### [CVE-2025-32441](https://cve.now/CVE-2025-32441): Rack session gets restored after deletion - Severity: Medium 4.2 - Published: May 7, 2025 - Affected: fixed in 2.2.14. ### [CVE-2025-27610](https://cve.now/CVE-2025-27610): Local File Inclusion in Rack::Static - Severity: High 7.5 - Published: Mar 10, 2025 - Affected: fixed in 2.2.13; from 3.0, fixed in 3.0.14; from 3.1, fixed in 3.1.12. ### [CVE-2025-27111](https://cve.now/CVE-2025-27111): Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection - Severity: Medium 6.9 - Published: Mar 4, 2025 - Affected: fixed in 2.2.12; from 3.0, fixed in 3.0.13; from 3.1, fixed in 3.1.11. ### [CVE-2025-25184](https://cve.now/CVE-2025-25184): Possible Log Injection in Rack::CommonLogger - Severity: Medium 5.7 - Published: Feb 12, 2025 - Affected: fixed in 2.2.11; from 3.0, fixed in 3.0.12; from 3.1, fixed in 3.1.10. ### [CVE-2023-27539](https://cve.now/CVE-2023-27539): There is a denial of service vulnerability in the header parsing component of Rack. - Severity: Medium 5.3 - Published: Jan 9, 2025 - Affected: from 2.0.0, fixed in 2.2.6.4; from 3.0.0, fixed in 3.0.6.1. ### [CVE-2024-39316](https://cve.now/CVE-2024-39316): Rack ReDoS Vulnerability in HTTP Accept Headers Parsing - Severity: Medium 6.5 - Published: Jul 2, 2024 - Affected: from 3.1.0, fixed in 3.1.5. ### [CVE-2024-26141](https://cve.now/CVE-2024-26141): Possible DoS Vulnerability with Range Header in Rack - Severity: Medium 5.8 - Published: Feb 28, 2024 - Affected: from 3.0.0, fixed in 3.0.9.1; from 1.3.0, fixed in 2.2.8.1. ### [CVE-2024-25126](https://cve.now/CVE-2024-25126): Rack ReDos in content type parsing (2nd degree polynomial) - Severity: Medium 5.3 - Published: Feb 28, 2024 - Affected: from 3.0.0, fixed in 3.0.9.1; from 0.4, fixed in 2.2.8.1. ### [CVE-2024-26146](https://cve.now/CVE-2024-26146): Possible Denial of Service Vulnerability in Rack Header Parsing - Severity: Medium 5.3 - Published: Feb 28, 2024 - Affected: from 3.0.0, fixed in 3.0.9.1; from 2.2.0, fixed in 2.2.8.1; from 2.1.0, fixed in 2.1.4.4; fixed in 2.0.9.4. ### [CVE-2023-27530](https://cve.now/CVE-2023-27530): A DoS vulnerability exists in Rack \= 1.5.0. - Severity: Unrated - Published: Feb 9, 2023 - Affected: from 1.5.0, fixed in 2.0.9.2; from 2.1.0.0, fixed in 2.1.4.2; from 2.2.0.0, fixed in 2.2.6.2; from 3.0.0.0, fixed in 3.0.4.1. ### [CVE-2022-30123](https://cve.now/CVE-2022-30123): A sequence injection vulnerability exists in Rack \<2.0.9.1, \<2.1.4.1 and \<2.2.3.1 which could allow is a possible shell escape in the Lint… - Severity: Unrated - Published: Dec 5, 2022 - Affected: fixed in 2.0.9.1; from 2.1, fixed in 2.1.4.1; from 2.2, fixed in 2.2.3.1. ### [CVE-2022-30122](https://cve.now/CVE-2022-30122): A possible denial of service vulnerability exists in Rack \<2.0.9.1, \<2.1.4.1 and \<2.2.3.1 in the multipart parsing component of Rack. - Severity: Unrated - Published: Dec 5, 2022 - Affected: from 1.2, fixed in 2.0.9.1; from 2.1, fixed in 2.1.4.1; from 2.2, fixed in 2.2.3.1. ### [CVE-2020-8161](https://cve.now/CVE-2020-8161): A directory traversal vulnerability exists in rack \< 2.2.0 that allows an attacker perform directory traversal vulnerability in the… - Severity: Unrated - Published: Jul 2, 2020 - Affected: fixed in 2.1.3. ### [CVE-2020-8184](https://cve.now/CVE-2020-8184): A reliance on cookies without validation/integrity check security vulnerability exists in rack \< 2.2.3, rack \< 2.1.4 that makes it is… - Severity: Unrated - Published: Jun 19, 2020 - Affected: fixed in 2.1.4; from 2.2.0, fixed in 2.2.3. ### [CVE-2019-16782](https://cve.now/CVE-2019-16782): Possible Information Leak / Session Hijack Vulnerability in Rack - Severity: Medium 6.3 - Published: Dec 18, 2019 - Affected: fixed in 1.6.12; from 2.0.0, fixed in 2.0.8. ### [CVE-2018-16471](https://cve.now/CVE-2018-16471): There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. - Severity: Unrated - Published: Nov 13, 2018 - Affected: from 2.0.0, fixed in 2.0.6; fixed in 1.6.11. ### [CVE-2018-16470](https://cve.now/CVE-2018-16470): There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. - Severity: Unrated - Published: Nov 13, 2018 - Affected: from 2.0.4, fixed in 2.0.6. ### [CVE-2015-3225](https://cve.now/CVE-2015-3225): lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote… - Severity: Unrated - Published: Jul 26, 2015 - Affected: from 1.5.0, fixed in 1.5.4; from 1.6.0, fixed in 1.6.2; from 1.4.0, fixed in 1.4.6. ### [CVE-2013-0184](https://cve.now/CVE-2013-0184): Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x… - Severity: Unrated - Published: Mar 1, 2013 - Affected: from 1.1.0, fixed in 1.1.5; from 1.2.0, fixed in 1.2.7; from 1.3.0, fixed in 1.3.9; from 1.4.0, fixed in 1.4.4. ### [CVE-2013-0183](https://cve.now/CVE-2013-0183): multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory… - Severity: Unrated - Published: Mar 1, 2013 - Affected: from 1.3.0, fixed in 1.3.8; from 1.4.0, fixed in 1.4.3. ### [CVE-2012-6109](https://cve.now/CVE-2012-6109): lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular… - Severity: Unrated - Published: Mar 1, 2013 - Affected: fixed in 1.1.4; from 1.2.0, fixed in 1.2.6; from 1.3.0, fixed in 1.3.7; from 1.4.0, fixed in 1.4.2. ### [CVE-2013-0263](https://cve.now/CVE-2013-0263): Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6… - Severity: Unrated - Published: Feb 8, 2013 - Affected: from 1.5.0, fixed in 1.5.2; from 1.4.0, fixed in 1.4.5; from 1.3.0, fixed in 1.3.10; from 1.2.0, fixed in 1.2.8; from 1.1.0, fixed in 1.1.6. ### [CVE-2013-0262](https://cve.now/CVE-2013-0262): rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the… - Severity: Unrated - Published: Feb 8, 2013 - Affected: from 1.5.0, fixed in 1.5.2; from 1.4.0, fixed in 1.4.5. ### [CVE-2011-5036](https://cve.now/CVE-2011-5036): Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to… - Severity: Unrated - Published: Dec 30, 2011 - Affected: fixed in 1.1.3; from 1.2.0, fixed in 1.2.5; from 1.3.0, fixed in 1.3.6. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/rubygems/rack Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.