Rack vulnerabilities

Products

• Rack 39
• Rack-session 2

Newest

• rack rack-session Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization CVE-2026-39324 Public exploitFix available 9.3 CriticalApril 7, 2026
• rack Rack: Header injection in multipart requests CVE-2026-26962 Fix available 4.8 MediumApril 2, 2026
• rack Rack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass. CVE-2026-34835 Public exploitFix available 4.8 MediumApril 2, 2026
• rack, red hat logging subsystem for red hat openshift, 3scale api management platform 2 +4 more +6 more Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser CVE-2026-34827 Fix available 7.5 HighApril 2, 2026
• rack Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing CVE-2026-32762 Fix available 4.8 MediumApril 2, 2026
• rack Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginx CVE-2026-34830 Fix available 5.9 MediumApril 2, 2026
• rack, red hat logging subsystem for red hat openshift, 3scale api management platform 2 +4 more +6 more Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length CVE-2026-34829 Fix available 7.5 HighApril 2, 2026
• rack Rack: Unbounded Range Count in get_byte_ranges Enables DoS CVE-2026-34826 Fix available 5.3 MediumApril 2, 2026
• rack Rack: Rack::Static header_rules bypass via URL-encoded paths CVE-2026-34786 Fix available 5.3 MediumApril 2, 2026
• rack, red hat satellite 6 +1 more Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching CVE-2026-34785 Fix available 7.5 HighApril 2, 2026
• rack Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation CVE-2026-34763 Fix available 5.3 MediumApril 2, 2026
• rack Rack: Content-Length mismatch in Rack::Files error responses CVE-2026-34831 Fix available 4.8 MediumApril 2, 2026
• rack Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypass CVE-2026-26961 Fix available 3.7 LowApril 2, 2026
• rack Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header CVE-2026-34230 Fix available 5.3 MediumApril 2, 2026
• rack Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href CVE-2026-25500 Fix available 5.4 MediumFebruary 17, 2026
• rack, red hat logging subsystem for red hat openshift, 3scale api management platform 2 +4 more +6 more Rack has a Directory Traversal via Rack:Directory CVE-2026-22860 Fix available 7.5 HighFebruary 17, 2026
• rack Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing CVE-2025-61919 Fix available 7.5 HighOctober 10, 2025
• rack Rack has Possible Information Disclosure Vulnerability CVE-2025-61780 Fix available 5.8 MediumOctober 10, 2025
• rack Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) CVE-2025-61772 Fix available 7.5 HighOctober 7, 2025
• rack Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) CVE-2025-61771 Fix available 7.5 HighOctober 7, 2025
• rack Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) CVE-2025-61770 Fix available 7.5 HighOctober 7, 2025
• rack Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters CVE-2025-59830 Fix available 7.5 HighSeptember 25, 2025
• rack ReDoS Vulnerability in Rack::Multipart handle_mime_head CVE-2025-49007 Fix available 6.6 MediumJune 4, 2025
• rack rack-session Rack session gets restored after deletion CVE-2025-46336 Fix available 4.2 MediumMay 8, 2025
• rack Unbounded-Parameter DoS in Rack::QueryParser CVE-2025-46727 Fix available 7.5 HighMay 7, 2025
• rack Rack session gets restored after deletion CVE-2025-32441 Fix available 4.2 MediumMay 7, 2025
• rack Local File Inclusion in Rack::Static CVE-2025-27610 Fix available 7.5 HighMarch 10, 2025
• rack Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection CVE-2025-27111 Fix available 6.9 MediumMarch 4, 2025
• rack Possible Log Injection in Rack::CommonLogger CVE-2025-25184 Fix available 5.7 MediumFebruary 12, 2025
• rack Rack ReDoS Vulnerability in HTTP Accept Headers Parsing CVE-2024-39316 Fix available 6.5 MediumJuly 2, 2024
• rack rack-contrib rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter CVE-2024-35231 Fix available 8.6 HighMay 27, 2024
• rack, debian linux +1 more Rack ReDos in content type parsing (2nd degree polynomial) CVE-2024-25126 Fix available EPSS 35.4% 5.3 MediumFebruary 28, 2024
• rack, debian linux +1 more Possible DoS Vulnerability with Range Header in Rack CVE-2024-26141 Fix available 5.8 MediumFebruary 28, 2024
• rack, debian linux +1 more Possible Denial of Service Vulnerability in Rack Header Parsing CVE-2024-26146 Fix available 5.3 MediumFebruary 28, 2024
• rack, debian linux +1 more Possible Denial of Service Vulnerability in Rack's header parsing CVE-2023-27539 Fix available 5.3 MediumMarch 15, 2023
• rack, debian linux +1 more Rack has possible DoS Vulnerability in Multipart MIME parsing CVE-2023-27530 Fix available 7.5 HighMarch 8, 2023
• rack Denial of Service Vulnerability in Rack Content-Disposition parsing CVE-2022-44571 Fix available 7.5 HighJanuary 18, 2023
• rack Denial of service via header parsing in Rack CVE-2022-44570 Fix available 7.5 HighJanuary 18, 2023
• rack Denial of service via multipart parsing in Rack CVE-2022-44572 Fix available 7.5 HighJanuary 18, 2023
• rack, fedoraproject fedora, opensuse leap +2 more Possible Information Leak / Session Hijack Vulnerability in Rack CVE-2019-16782 Fix available 6.3 MediumDecember 18, 2019
• rack Rack vulnerable to Denial of Service CVE-2018-16470 Fix available 7.5 HighNovember 13, 2018
• rack, debian linux +1 more Rack vulnerable to Cross-site Scripting CVE-2018-16471 Fix available 6.1 MediumNovember 13, 2018