Rack vulnerabilities
41 CVEs and advisories name Rack as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-125111Rack: Multipart parsing allows DoS via unbounded scan buffer growth
- CVE-2026-125110Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch
- CVE-2026-125109Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835
- CVE-2026-125108Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass
- CVE-2026-39324Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization
- CVE-2026-26962Rack: Header injection in multipart requests
- CVE-2026-34835Rack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass.
- CVE-2026-34827Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser
- CVE-2026-32762Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing
- CVE-2026-34830Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginx
- CVE-2026-34829Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length
- CVE-2026-34826Rack: Unbounded Range Count in get_byte_ranges Enables DoS
- CVE-2026-34786Rack: Rack::Static header_rules bypass via URL-encoded paths
- CVE-2026-34785Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching
- CVE-2026-34763Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation
- CVE-2026-34831Rack: Content-Length mismatch in Rack::Files error responses
- CVE-2026-26961Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypass
- CVE-2026-34230Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header
- CVE-2026-25500Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href
- CVE-2026-22860Rack has a Directory Traversal via Rack:Directory
- CVE-2025-61919Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing
- CVE-2025-61780Rack has Possible Information Disclosure Vulnerability
- CVE-2025-61772Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
- CVE-2025-61771Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
- CVE-2025-61770Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)
- CVE-2025-59830Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters
- CVE-2025-49007ReDoS Vulnerability in Rack::Multipart handle_mime_head
- CVE-2025-46336Rack session gets restored after deletion
- CVE-2025-46727Unbounded-Parameter DoS in Rack::QueryParser
- CVE-2025-32441Rack session gets restored after deletion