Browse CVEs

CRITICAL 9.8 CVE-2026-39324 Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failu… Rack Session 2.1.2+ Fix from $2,3002026-04-07 HIGH 7.5 CVE-2026-34827 Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Multipart::Parser#handle_mi… Rack 3.1.21 / 3.2.6+ Fix from $1,9502026-04-02 MEDIUM 6.5 CVE-2026-34835 Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host hea… Rack 3.1.21 / 3.2.6+ Fix from $1,6002026-04-02 MEDIUM 6.5 CVE-2026-32762 Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21 and 3.2.0 to before 3.2.6, Rack::Utils.forwarded_values parse… Rack 3.1.21 / 3.2.6+ Fix from $1,6002026-04-02 MEDIUM 6.5 CVE-2026-26962 Rack is a modular Ruby web server interface. From version 3.2.0 to before version 3.2.6, Rack::Multipart::Parser unfolds folded multipart part header… Rack 3.2.6+ Fix from $1,6002026-04-02 HIGH 7.5 CVE-2026-34829 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a Bo… Rack 2.2.23 / 3.1.21+ Fix from $1,9502026-04-02 HIGH 7.5 CVE-2026-34830 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path interpolates the value of the… Rack 2.2.23 / 3.1.21+ Fix from $1,9502026-04-02 MEDIUM 6.5 CVE-2026-34831 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Files#fail sets the Content-Length response header us… Rack 2.2.23 / 3.1.21+ Fix from $1,6002026-04-02 HIGH 7.5 CVE-2026-34826 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.get_byte_ranges parses the HTTP Range header wi… Rack 2.2.23 / 3.1.21+ Fix from $1,9502026-04-02 MEDIUM 5.3 CVE-2026-34786 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static#applicable_rules evaluates several header_rule… Rack 2.2.23 / 3.1.21+ Fix from $1,6002026-04-02 HIGH 7.5 CVE-2026-34785 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served … Rack 2.2.23 / 3.1.21+ Fix from $1,9502026-04-02 MEDIUM 5.3 CVE-2026-34763 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Directory interpolates the configured root path direc… Rack 2.2.23 / 3.1.21+ Fix from $1,6002026-04-02 HIGH 7.5 CVE-2026-34230 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.select_best_encoding processes Accept-Encoding … Rack 2.2.23 / 3.1.21+ Fix from $1,9502026-04-02 MEDIUM 5.3 CVE-2026-26961 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter fro… Rack 2.2.23 / 3.1.21+ Fix from $1,6002026-04-02 MEDIUM 5.4 CVE-2026-25500 Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where e… Rack 2.2.22 / 3.1.20+ Fix from $1,6002026-02-18 HIGH 7.5 CVE-2026-22860 Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match o… Rack 2.2.22 / 3.1.20+ Fix from $1,9502026-02-18 HIGH 7.5 CVE-2025-61919 Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, `Rack::Request#POST` reads the entire request body into mem… Rack 2.2.20 / 3.1.18+ Fix from $1,9502025-10-10 MEDIUM 5.3 CVE-2025-61780 Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, a possible information disclosure vulnerability existed in … Rack 2.2.20 / 3.1.18+ Fix from $1,6002025-10-10 HIGH 7.5 CVE-2025-61771 Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, ``Rack::Multipart::Parser` stores non-file form fields (… Rack 2.2.19 / 3.1.17+ Fix from $1,9502025-10-07 HIGH 7.5 CVE-2025-61772 Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` can accumulate unbounded data … Rack 2.2.19 / 3.1.17+ Fix from $1,9502025-10-07 HIGH 7.5 CVE-2025-61770 Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` buffers the entire multipart p… Rack 2.2.19 / 3.1.17+ Fix from $1,9502025-10-07 HIGH 7.5 CVE-2025-59830 Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &,… Rack 2.2.18+ Fix from $1,9502025-09-25 MEDIUM 5.3 CVE-2025-49007 Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the… Rack 3.1.16+ Fix from $1,6002025-06-04 HIGH 7.5 CVE-2025-46727 Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, `Rack::QueryParser` parses query strings and `application/… Rack 2.2.14 / 3.0.16+ Fix from $1,9502025-05-07 HIGH 7.5 CVE-2025-27610 Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files unde… Rack 2.2.13 / 3.0.14+ Fix from $1,9502025-03-10 HIGH 7.5 CVE-2025-27111 Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacke… Rack 2.2.12 / 3.0.13+ Fix from $1,9502025-03-04 MEDIUM 6.5 CVE-2025-25184 Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited… Rack 2.2.11 / 3.0.12+ Fix from $1,6002025-02-12 MEDIUM 5.3 CVE-2023-27539 There is a denial of service vulnerability in the header parsing component of Rack. Rack 2.2.6.4 / 3.0.6.1+ Fix from $1,6002025-01-09 MEDIUM 6.5 CVE-2024-39316 Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.5, Regular Expression Denial of Service (ReDoS) vulne… Rack 3.1.5+ Fix from $1,6002024-07-02 HIGH 7.5 CVE-2024-25126EPSS 35% Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expec… Rack 2.2.8.1 / 3.0.9.1+ Fix from $1,9502024-02-29