# cve.now: Rack

The newest entries naming Rack as an affected vendor (up to 200), of 41 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-125111](https://cve.now/CVE-2026-125111.md): Rack: Multipart parsing allows DoS via unbounded scan buffer growth (CVSS 7.5)
- [CVE-2026-125110](https://cve.now/CVE-2026-125110.md): Rack: Rack::Static header\_rules bypass via dot-segment normalization mismatch (CVSS 5.3)
- [CVE-2026-125109](https://cve.now/CVE-2026-125109.md): Rack: Rack::Request#host\_with\_port (and #base\_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835 (CVSS 4.8)
- [CVE-2026-125108](https://cve.now/CVE-2026-125108.md): Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass (CVSS 3.7)
- [CVE-2026-39324](https://cve.now/CVE-2026-39324.md): Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization (CVSS 9.3)
- [CVE-2026-26962](https://cve.now/CVE-2026-26962.md): Rack: Header injection in multipart requests (CVSS 4.8)
- [CVE-2026-34835](https://cve.now/CVE-2026-34835.md): Rack: \`Rack::Request\` accepts invalid Host characters, enabling host allowlist bypass. (CVSS 4.8)
- [CVE-2026-34827](https://cve.now/CVE-2026-34827.md): Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser (CVSS 7.5)
- [CVE-2026-32762](https://cve.now/CVE-2026-32762.md): Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing (CVSS 4.8)
- [CVE-2026-34830](https://cve.now/CVE-2026-34830.md): Rack: Rack::Sendfile regex injection via HTTP\_X\_ACCEL\_MAPPING header allows arbitrary file reads through nginx (CVSS 5.9)
- [CVE-2026-34829](https://cve.now/CVE-2026-34829.md): Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length (CVSS 7.5)
- [CVE-2026-34826](https://cve.now/CVE-2026-34826.md): Rack: Unbounded Range Count in get\_byte\_ranges Enables DoS (CVSS 5.3)
- [CVE-2026-34786](https://cve.now/CVE-2026-34786.md): Rack: Rack::Static header\_rules bypass via URL-encoded paths (CVSS 5.3)
- [CVE-2026-34785](https://cve.now/CVE-2026-34785.md): Rack: Local file inclusion in \`Rack::Static\` via URL Prefix Matching (CVSS 7.5)
- [CVE-2026-34763](https://cve.now/CVE-2026-34763.md): Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation (CVSS 5.3)
- [CVE-2026-34831](https://cve.now/CVE-2026-34831.md): Rack: Content-Length mismatch in Rack::Files error responses (CVSS 4.8)
- [CVE-2026-26961](https://cve.now/CVE-2026-26961.md): Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypass (CVSS 3.7)
- [CVE-2026-34230](https://cve.now/CVE-2026-34230.md): Rack: Quadratic complexity in Rack::Utils.select\_best\_encoding via wildcard Accept-Encoding header (CVSS 5.3)
- [CVE-2026-25500](https://cve.now/CVE-2026-25500.md): Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href (CVSS 5.4)
- [CVE-2026-22860](https://cve.now/CVE-2026-22860.md): Rack has a Directory Traversal via Rack:Directory (CVSS 7.5)
- [CVE-2025-61919](https://cve.now/CVE-2025-61919.md): Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing (CVSS 7.5)
- [CVE-2025-61780](https://cve.now/CVE-2025-61780.md): Rack has Possible Information Disclosure Vulnerability (CVSS 5.8)
- [CVE-2025-61772](https://cve.now/CVE-2025-61772.md): Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) (CVSS 7.5)
- [CVE-2025-61771](https://cve.now/CVE-2025-61771.md): Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) (CVSS 7.5)
- [CVE-2025-61770](https://cve.now/CVE-2025-61770.md): Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVSS 7.5)
- [CVE-2025-59830](https://cve.now/CVE-2025-59830.md): Rack QueryParser has an unsafe default allowing params\_limit bypass via semicolon-separated parameters (CVSS 7.5)
- [CVE-2025-49007](https://cve.now/CVE-2025-49007.md): ReDoS Vulnerability in Rack::Multipart handle\_mime\_head (CVSS 6.6)
- [CVE-2025-46336](https://cve.now/CVE-2025-46336.md): Rack session gets restored after deletion (CVSS 4.2)
- [CVE-2025-46727](https://cve.now/CVE-2025-46727.md): Unbounded-Parameter DoS in Rack::QueryParser (CVSS 7.5)
- [CVE-2025-32441](https://cve.now/CVE-2025-32441.md): Rack session gets restored after deletion (CVSS 4.2)
- [CVE-2025-27610](https://cve.now/CVE-2025-27610.md): Local File Inclusion in Rack::Static (CVSS 7.5)
- [CVE-2025-27111](https://cve.now/CVE-2025-27111.md): Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection (CVSS 6.9)
- [CVE-2025-25184](https://cve.now/CVE-2025-25184.md): Possible Log Injection in Rack::CommonLogger (CVSS 5.7)
- [CVE-2024-39316](https://cve.now/CVE-2024-39316.md): Rack ReDoS Vulnerability in HTTP Accept Headers Parsing (CVSS 6.5)
- [CVE-2024-35231](https://cve.now/CVE-2024-35231.md): rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler\_runs" parameter (CVSS 8.6)
- [CVE-2024-26141](https://cve.now/CVE-2024-26141.md): Possible DoS Vulnerability with Range Header in Rack (CVSS 5.8)
- [CVE-2024-25126](https://cve.now/CVE-2024-25126.md): Rack ReDos in content type parsing (2nd degree polynomial) (CVSS 5.3)
- [CVE-2024-26146](https://cve.now/CVE-2024-26146.md): Possible Denial of Service Vulnerability in Rack Header Parsing (CVSS 5.3)
- [CVE-2019-16782](https://cve.now/CVE-2019-16782.md): Possible Information Leak / Session Hijack Vulnerability in Rack (CVSS 6.3)
- [CVE-2018-16471](https://cve.now/CVE-2018-16471.md): There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. (no CVSS)
- [CVE-2018-16470](https://cve.now/CVE-2018-16470.md): There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/rack
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.