RA
Product
rack
37
CVEs
0
On KEV
7.5
Max CVSS
0
New 30D
Severity mix
Critical 0High 22Medium 15Low 0
Watch
Add rack to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-34827 | 7.5 | Apr 2 | Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser Affected: >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 |
| CVE-2026-34830 | 7.5 | Apr 2 | Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginx Affected: < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 |
| CVE-2026-34829 | 7.5 | Apr 2 | Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length Affected: < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 |
| CVE-2026-34826 | 7.5 | Apr 2 | Rack: Unbounded Range Count in get_byte_ranges Enables DoS Affected: < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 |
| CVE-2026-34785 | 7.5 | Apr 2 | Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching Affected: < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 |
| CVE-2026-34230 | 7.5 | Apr 2 | Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header Affected: < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 |
| CVE-2026-22860 | 7.5 | Feb 18 | Rack has a Directory Traversal via Rack:Directory Affected: < 2.2.22; >= 3.0.0.beta1, < 3.1.20; >= 3.2.0, < 3.2.5 |
| CVE-2025-61919 | 7.5 | Oct 10 | Rack is a modular Ruby web server interface Affected: before 2.2.20; 3.0.0 before 3.1.18; 3.2.0 before 3.2.3 |
| CVE-2025-61772 | 7.5 | Oct 7 | Rack is a modular Ruby web server interface Affected: before 2.2.19; 3.1.0 before 3.1.17; 3.2.0 before 3.2.2 |
| CVE-2025-61771 | 7.5 | Oct 7 | Rack is a modular Ruby web server interface Affected: before 2.2.19; 3.1.0 before 3.1.17; 3.2.0 before 3.2.2 |
| CVE-2025-61770 | 7.5 | Oct 7 | Rack is a modular Ruby web server interface Affected: before 2.2.19; 3.1.0 before 3.1.17; 3.2.0 before 3.2.2 |
| CVE-2025-59830 | 7.5 | Sep 25 | Rack is a modular Ruby web server interface Affected: before 2.2.18 |
| CVE-2025-46727 | 7.5 | May 7 | Rack is a modular Ruby web server interface Affected: before 2.2.14; 3.0.0 before 3.0.16; 3.1.0 before 3.1.14 |
| CVE-2025-27610 | 7.5 | Mar 10 | Rack provides an interface for developing web applications in Ruby Affected: before 2.2.13; 3.0.0 before 3.0.14; 3.1.0 before 3.1.12 |
| CVE-2025-27111 | 7.5 | Mar 4 | Rack is a modular Ruby web server interface Affected: before 2.2.12; 3.0.0 before 3.0.13; 3.1.0 before 3.1.11 |
| CVE-2024-26146 | 7.5 | Feb 29 | Rack is a modular Ruby web server interface Affected: 0.4 before 2.0.9.4; 2.1.0 before 2.1.4.4; 2.2.0 before 2.2.8.1 |
| CVE-2024-26141 | 7.5 | Feb 29 | Rack is a modular Ruby web server interface Affected: 1.3.0 before 2.2.8.1; 3.0.0 before 3.0.9.1 |
| CVE-2024-25126 | 7.5 | Feb 29 | Rack is a modular Ruby web server interface Affected: 0.4 before 2.2.8.1; 3.0.0 before 3.0.9.1 |
| CVE-2023-27530 | 7.5 | Mar 10 | A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that… Affected: before 2.0.9.3; 2.1.0 before 2.1.4.3; 2.2.0 before 2.2.6.3; 3.0.0 before 3.0.4.2 |
| CVE-2022-44572 | 7.5 | Feb 9 | A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause… Affected: before 2.0.9.2; 2.1.0 before 2.1.4.2; 2.2.0 before 2.2.4.1 |
| CVE-2022-44571 | 7.5 | Feb 9 | There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1 Affected: 2.0.0 before 2.0.9.2; 2.1.0 before 2.1.4.2; 2.2.0 before 2.2.6.1; 3.0.0.0 before 3.0.4.1 |
| CVE-2022-44570 | 7.5 | Feb 9 | A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0 Affected: 1.5.0 before 2.0.9.2; 2.1.0 before 2.1.4.2; 2.2.0 before 2.2.6.1; 3.0.0 before 3.0.4.1 |
| CVE-2026-26962 | 6.5 | Apr 2 | Rack: Header injection in multipart requests Affected: >= 3.2.0, < 3.2.6 |
| CVE-2026-34835 | 6.5 | Apr 2 | Rack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass. Affected: >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 |
| CVE-2026-32762 | 6.5 | Apr 2 | Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing Affected: >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 |
| CVE-2026-34831 | 6.5 | Apr 2 | Rack: Content-Length mismatch in Rack::Files error responses Affected: < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 |
| CVE-2025-25184 | 6.5 | Feb 12 | Rack provides an interface for developing web applications in Ruby Affected: before 2.2.11; 3.0.0 before 3.0.12; 3.1.0 before 3.1.10 |
| CVE-2024-39316 | 6.5 | Jul 2 | Rack is a modular Ruby web server interface Affected: 3.1.0 before 3.1.5 |
| CVE-2019-16782 | 5.9 | Dec 18 | There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack) Affected: before 1.6.12; 2.0.0 before 2.0.8 |
| CVE-2026-25500 | 5.4 | Feb 18 | Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href Affected: < 2.2.22; >= 3.0.0.beta1, < 3.1.20; >= 3.2.0, < 3.2.5 |
| CVE-2026-34786 | 5.3 | Apr 2 | Rack: Rack::Static header_rules bypass via URL-encoded paths Affected: < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 |
| CVE-2026-34763 | 5.3 | Apr 2 | Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation Affected: < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 |
| CVE-2026-26961 | 5.3 | Apr 2 | Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypass Affected: < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 |
| CVE-2025-61780 | 5.3 | Oct 10 | Rack is a modular Ruby web server interface Affected: before 2.2.20; 3.0.0 before 3.1.18; 3.2.0 before 3.2.3 |
| CVE-2025-49007 | 5.3 | Jun 4 | Rack is a modular Ruby web server interface Affected: 3.1.0 before 3.1.16 |
| CVE-2023-27539 | 5.3 | Jan 9 | There is a denial of service vulnerability in the header parsing component of Rack Affected: 2.0.0 before 2.2.6.4; 3.0.0 before 3.0.6.1 |
| CVE-2025-32441 | 4.2 | May 7 | Rack is a modular Ruby web server interface Affected: before 2.2.14 |
Showing 37