{"id":"CVE-2018-16471","aliases":["DEBIAN-CVE-2018-16471","DLA-1585-1","EUVD-2018-0731","GHSA-5r2p-j47h-mhpg","MGASA-2018-0449","SUSE-SU-2019:1440-1","SUSE-SU-2020:0359-1","UBUNTU-CVE-2018-16471","USN-4089-1","openSUSE-SU-2020:0214-1","openSUSE-SU-2024:11344-1","openSUSE-SU-2024:11346-1","openSUSE-SU-2024:12119-1","openSUSE-SU-2024:12397-1","openSUSE-SU-2024:12974-1","openSUSE-SU-2024:13167-1","openSUSE-SU-2024:13726-1","openSUSE-SU-2024:13727-1","openSUSE-SU-2025:14811-1","openSUSE-SU-2025:14875-1","openSUSE-SU-2026:10286-1","openSUSE-SU-2026:10358-1"],"status":"published","title":"Rack vulnerable to Cross-site Scripting","description":"There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0189,"percentile":0.79713,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2018-11-13T00:00:00Z","modified":"2026-10-24T10:30:31Z","fixes":[{"ecosystem":"RubyGems","package":"rack","fixed_in":["2.0.6","1.6.11"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-rack","fixed_in":["1.6.4-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-rack","fixed_in":["1.6.4-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-rack","fixed_in":["1.6.4-6"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"ruby-rack","fixed_in":["1.5.2-3+deb8u2"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"ruby-rack","fixed_in":["1.6.11-1.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-rack","fixed_in":["1.6.11-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"rubygem-rack","fixed_in":["1.6.11-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-rack","fixed_in":["1.6.11-3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"ruby-rack","fixed_in":["1.6.4-3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"ruby-rack","fixed_in":["1.6.4-4ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.6"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-6"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-3+deb8u2"}]}],"versions":["1.5.2-3","1.5.2-3+deb8u1"]},{"source":"osv","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.6"}]}],"versions":["2.0.1","2.0.2","2.0.3","2.0.4","2.0.5"]},{"source":"osv","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11"}]}],"versions":["0.1.0","0.2.0","0.3.0","0.4.0","0.9.0","0.9.1","1.0.0","1.0.1","1.1.0","1.1.1","1.1.1.pre","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.3.0","1.3.0.beta","1.3.0.beta2","1.3.1","1.3.10","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.5.0","1.5.0.beta.1","1.5.0.beta.2","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.6.0","1.6.0.beta","1.6.0.beta2","1.6.1","1.6.10","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","1.6.8","1.6.9"]},{"source":"osv","ecosystem":"Mageia:6","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-1.mga6"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.11-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-3ubuntu0.1"}]}],"versions":["1.5.2-4","1.6.4-2","1.6.4-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-4ubuntu0.1"}]}],"versions":["1.6.4-4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-3ubuntu0.1"}]}],"versions":["1.5.2-4","1.6.4-2","1.6.4-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-4ubuntu0.1"}]}],"versions":["1.6.4-4"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-lp151.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.1-1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-1.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-1.2"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.1-1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8.1-1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-1.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.22-1.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.18-1.3"}]}],"bundled":18}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"rack","product":"rack"},{"vendor":"rack_project","product":"rack"}],"references":[{"url":"https://groups.google.com/forum/#%21topic/rubyonrails-security/GKsAFT924Ag","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/11/msg00022.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00032.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4089-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00016.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16471","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/rubyonrails-security/GKsAFT924Ag","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2018-16471.yml","tags":["web"]},{"url":"https://groups.google.com/forum/#!topic/ruby-security-ann/NAalCee8n6o","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5r2p-j47h-mhpg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-16471","tags":["advisory"]},{"url":"https://github.com/rack/rack","tags":["package"]},{"url":"https://usn.ubuntu.com/4089-1","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0449.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23813","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2018/11/05/2","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191440-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1114828","tags":["report"]},{"url":"https://bugzilla.suse.com/1116600","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16471","tags":["web"]},{"url":"https://bugzilla.suse.com/SCRD-7716","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200359-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1159548","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16782","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-16471","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4089-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-16471","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PWBQQBBNBE3RHXMQEZDL7RQ4YUOWFJS5/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26146","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FLQ74D2IZAJC5KD6QXVUZAQ6O5LNAWZX/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25184","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MOZFATD6SCQREBY3SZW5KQJPN6KN7A6D/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25500","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-16471","description":"There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.","status":"published","published":"2018-11-13T23:00:00Z","modified":"2024-08-05T10:24:32.587Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:11.072321Z"}],"euvd":[{"id":"EUVD-2018-0731","description":"There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.","status":"published","published":"2018-11-13T23:00:00Z","modified":"2024-08-05T10:24:32Z","updated_at":"2026-11-03T02:39:41.750379Z"}],"ghsa":[{"id":"GHSA-5r2p-j47h-mhpg","title":"Rack vulnerable to Cross-site Scripting","description":"There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.","status":"published","published":"2018-11-15T15:59:08Z","modified":"2023-11-04T05:04:39Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:12.407027Z"}],"nvd":[{"id":"CVE-2018-16471","description":"There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.","status":"published","published":"2018-11-13T23:29:00.31Z","modified":"2026-06-17T01:44:21.053Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:47.196456Z"}],"osv":[{"id":"CVE-2018-16471","description":"There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.","status":"published","published":"2018-11-13T23:29:00.31Z","modified":"2026-10-24T10:30:31.080151666Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:08.533609Z"},{"id":"DEBIAN-CVE-2018-16471","description":"There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.","status":"published","published":"2018-11-13T23:29:00.31Z","modified":"2026-10-23T18:03:00.476100576Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"GHSA-5r2p-j47h-mhpg","title":"Rack vulnerable to Cross-site Scripting","description":"There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.","status":"published","published":"2018-11-15T15:59:08Z","modified":"2024-02-18T05:22:09.08848Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"UBUNTU-CVE-2018-16471","description":"There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.","status":"published","published":"2018-11-13T00:00:00Z","modified":"2026-02-04T03:46:27.690499Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"DLA-1585-1","title":"ruby-rack - security update","status":"published","published":"2018-11-21T00:00:00Z","modified":"2026-03-09T01:19:20.408197Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"MGASA-2018-0449","title":"Updated ruby-rack packages fix security vulnerability","description":"There is a possible XSS vulnerability in Rack.  Carefully crafted\nrequests can impact the data returned by the `scheme` method on\n`Rack::Request`.Applications that expect the scheme to be limited to\n\"http\" or \"https\" and do not escape the return value could be vulnerable\nto an XSS attack (CVE-2018-16471).\n","status":"published","published":"2018-11-15T22:04:32Z","modified":"2026-04-16T06:23:09.335993779Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2020:0214-1","title":"Security update for rubygem-rack","description":"This update for rubygem-rack to version 2.0.8 fixes the following issues:\n\n- CVE-2018-16471: Fixed a cross-site scripting (XSS) flaw via the scheme method on Rack::Request (bsc#1116600).\n- CVE-2019-16782: Fixed a possible information leak and session hijack vulnerability (bsc#1159548).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-02-12T15:13:37Z","modified":"2026-02-04T04:14:21.375332Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11344-1","title":"ruby2.7-rubygem-rack-2.2.3-1.7 on GA media","description":"These are all security issues fixed in the ruby2.7-rubygem-rack-2.2.3-1.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:23:37.231914Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:11346-1","title":"ruby2.7-rubygem-rack-2.0-2.0.9-1.10 on GA media","description":"These are all security issues fixed in the ruby2.7-rubygem-rack-2.0-2.0.9-1.10 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:39:52.777607Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:12119-1","title":"ruby3.1-rubygem-rack-2.2.3.1-1.1 on GA media","description":"These are all security issues fixed in the ruby3.1-rubygem-rack-2.2.3.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:41:57.98501Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:12397-1","title":"ruby3.1-rubygem-rack-2.2-2.2.4-1.1 on GA media","description":"These are all security issues fixed in the ruby3.1-rubygem-rack-2.2-2.2.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:59:09.934016Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:12974-1","title":"ruby3.2-rubygem-rack-2.2-2.2.7-1.1 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-rack-2.2-2.2.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:30:21.929927Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:13167-1","title":"ruby3.2-rubygem-rack-3.0.7-1.2 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-rack-3.0.7-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:42:45.897529Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:13726-1","title":"ruby3.3-rubygem-rack-3.0.9.1-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-rack-3.0.9.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:59.579529Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13727-1","title":"ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:07:46.684926Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2025:14811-1","title":"ruby3.4-rubygem-rack-2.2-2.2.11-1.1 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-rack-2.2-2.2.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-02-14T00:00:00Z","modified":"2026-02-04T04:22:14.520853Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:14875-1","title":"ruby3.4-rubygem-rack-3.1.12-1.1 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-rack-3.1.12-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-11T00:00:00Z","modified":"2025-05-07T18:08:49.787747Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:10286-1","title":"ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-rack-2.2-2.2.22-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-04T00:00:00Z","modified":"2026-03-23T04:54:39.054152Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10358-1","title":"ruby4.0-rubygem-rack-3.1.18-1.3 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-rack-3.1.18-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-13T00:00:00Z","modified":"2026-03-14T08:26:09.361493Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"SUSE-SU-2019:1440-1","title":"Security update for rubygem-rack","description":"This update for rubygem-rack fixes the following issues:\n\nSecurity issued fixed:\n\n- CVE-2018-16471: Fixed a cross-site scripting vulnerability via 'scheme' method (bsc#1116600).\n","status":"published","published":"2019-06-06T15:51:29Z","modified":"2026-02-04T03:59:41.233902Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2020:0359-1","title":"Security update for rubygem-rack","description":"This update for rubygem-rack to version 2.0.8 fixes the following issues:\n\n- CVE-2018-16471: Fixed a cross-site scripting (XSS) flaw via the scheme method on Rack::Request (bsc#1116600).\n- CVE-2019-16782: Fixed a possible information leak and session hijack vulnerability (bsc#1159548).\n","status":"published","published":"2020-02-07T09:40:05Z","modified":"2025-05-02T04:07:54.523081Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-4089-1","title":"ruby-rack vulnerability","description":"It was discovered that Rack incorrectly handled carefully crafted requests. A\nremote attacker could use this issue to execute a cross-site scripting (XSS)\nattack.\n","status":"published","published":"2019-08-07T16:44:21Z","modified":"2026-02-10T04:41:35Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}