RA
Vendor
rack
38
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-39324 | RA rack-session rack | 9.8 | Apr 7 | Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization |
| CVE-2026-26962 | RA rack rack | 6.5 | Apr 2 | Rack: Header injection in multipart requests |
| CVE-2026-34835 | RA rack rack | 6.5 | Apr 2 | Rack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass. |
| CVE-2026-34827 | RA rack rack | 7.5 | Apr 2 | Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser |
| CVE-2026-32762 | RA rack rack | 6.5 | Apr 2 | Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing |
| CVE-2026-34830 | RA rack rack | 7.5 | Apr 2 | Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginx |
| CVE-2026-34829 | RA rack rack | 7.5 | Apr 2 | Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length |
| CVE-2026-34826 | RA rack rack | 7.5 | Apr 2 | Rack: Unbounded Range Count in get_byte_ranges Enables DoS |
| CVE-2026-34786 | RA rack rack | 5.3 | Apr 2 | Rack: Rack::Static header_rules bypass via URL-encoded paths |
| CVE-2026-34785 | RA rack rack | 7.5 | Apr 2 | Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching |
| CVE-2026-34763 | RA rack rack | 5.3 | Apr 2 | Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation |
| CVE-2026-34831 | RA rack rack | 6.5 | Apr 2 | Rack: Content-Length mismatch in Rack::Files error responses |
| CVE-2026-26961 | RA rack rack | 5.3 | Apr 2 | Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypass |
| CVE-2026-34230 | RA rack rack | 7.5 | Apr 2 | Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header |
| CVE-2026-25500 | RA rack rack | 5.4 | Feb 18 | Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href |
| CVE-2026-22860 | RA rack rack | 7.5 | Feb 18 | Rack has a Directory Traversal via Rack:Directory |
| CVE-2025-61919 | RA Rack Rack | 7.5 | Oct 10 | Rack is a modular Ruby web server interface |
| CVE-2025-61780 | RA Rack Rack | 5.3 | Oct 10 | Rack is a modular Ruby web server interface |
| CVE-2025-61772 | RA Rack Rack | 7.5 | Oct 7 | Rack is a modular Ruby web server interface |
| CVE-2025-61771 | RA Rack Rack | 7.5 | Oct 7 | Rack is a modular Ruby web server interface |
| CVE-2025-61770 | RA Rack Rack | 7.5 | Oct 7 | Rack is a modular Ruby web server interface |
| CVE-2025-59830 | RA Rack Rack | 7.5 | Sep 25 | Rack is a modular Ruby web server interface |
| CVE-2025-49007 | RA Rack Rack | 5.3 | Jun 4 | Rack is a modular Ruby web server interface |
| CVE-2025-46727 | RA Rack Rack | 7.5 | May 7 | Rack is a modular Ruby web server interface |
| CVE-2025-32441 | RA Rack Rack | 4.2 | May 7 | Rack is a modular Ruby web server interface |
| CVE-2025-27610 | RA Rack Rack | 7.5 | Mar 10 | Rack provides an interface for developing web applications in Ruby |
| CVE-2025-27111 | RA Rack Rack | 7.5 | Mar 4 | Rack is a modular Ruby web server interface |
| CVE-2025-25184 | RA Rack Rack | 6.5 | Feb 12 | Rack provides an interface for developing web applications in Ruby |
| CVE-2023-27539 | RA Rack Rack | 5.3 | Jan 9 | There is a denial of service vulnerability in the header parsing component of Rack |
| CVE-2024-39316 | RA Rack Rack | 6.5 | Jul 2 | Rack is a modular Ruby web server interface |
| CVE-2024-26146 | RA Rack Rack | 7.5 | Feb 29 | Rack is a modular Ruby web server interface |
| CVE-2024-26141 | RA Rack Rack | 7.5 | Feb 29 | Rack is a modular Ruby web server interface |
| CVE-2024-25126 | RA Rack Rack | 7.5 | Feb 29 | Rack is a modular Ruby web server interface |
| CVE-2023-27530 | RA Rack Rack | 7.5 | Mar 10 | A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that… |
| CVE-2022-44572 | RA Rack Rack | 7.5 | Feb 9 | A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause… |
| CVE-2022-44571 | RA Rack Rack | 7.5 | Feb 9 | There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1 |
| CVE-2022-44570 | RA Rack Rack | 7.5 | Feb 9 | A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0 |
| CVE-2019-16782 | RA Rack Rack | 5.9 | Dec 18 | There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack) |