RA
Product
rack
37
CVEs
0
On KEV
7.5
Max CVSS
0
New 30D
Severity mix
Critical 0High 22Medium 15Low 0
Watch
Add rack to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-26962 | 6.5 | Apr 2 | Rack: Header injection in multipart requests Affected: >= 3.2.0, < 3.2.6 |
| CVE-2026-34835 | 6.5 | Apr 2 | Rack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass. Affected: >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 |
| CVE-2026-32762 | 6.5 | Apr 2 | Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing Affected: >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 |
| CVE-2026-34831 | 6.5 | Apr 2 | Rack: Content-Length mismatch in Rack::Files error responses Affected: < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 |
| CVE-2025-25184 | 6.5 | Feb 12 | Rack provides an interface for developing web applications in Ruby Affected: before 2.2.11; 3.0.0 before 3.0.12; 3.1.0 before 3.1.10 |
| CVE-2024-39316 | 6.5 | Jul 2 | Rack is a modular Ruby web server interface Affected: 3.1.0 before 3.1.5 |
| CVE-2019-16782 | 5.9 | Dec 18 | There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack) Affected: before 1.6.12; 2.0.0 before 2.0.8 |
| CVE-2026-25500 | 5.4 | Feb 18 | Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href Affected: < 2.2.22; >= 3.0.0.beta1, < 3.1.20; >= 3.2.0, < 3.2.5 |
| CVE-2026-34786 | 5.3 | Apr 2 | Rack: Rack::Static header_rules bypass via URL-encoded paths Affected: < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 |
| CVE-2026-34763 | 5.3 | Apr 2 | Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation Affected: < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 |
| CVE-2026-26961 | 5.3 | Apr 2 | Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypass Affected: < 2.2.23; >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6 |
| CVE-2025-61780 | 5.3 | Oct 10 | Rack has Possible Information Disclosure Vulnerability Affected: < 2.2.20; >= 3.0, < 3.1.18; >= 3.2, < 3.2.3 |
| CVE-2025-49007 | 5.3 | Jun 4 | Rack is a modular Ruby web server interface Affected: 3.1.0 before 3.1.16 |
| CVE-2023-27539 | 5.3 | Jan 9 | There is a denial of service vulnerability in the header parsing component of Rack Affected: 2.0.0 before 2.2.6.4; 3.0.0 before 3.0.6.1 |
| CVE-2025-32441 | 4.2 | May 7 | Rack is a modular Ruby web server interface Affected: before 2.2.14 |
Showing 15