Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Rack — Vulnerabilities & Security Advisories 35

All 35 CVE vulnerabilities found in Rack, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security weaknesses specifically affecting the Rack web server framework used within Ruby applications. The collection encompasses a comprehensive range of vulnerabilities identified over the past decade, including remote code execution flaws, denial of service conditions, and various input validation errors reported by the community and security researchers. Visitors can utilize this resource to track official vendor advisories for Rack, understand the broader implications of specific weakness classes such as improper input handling or path traversal, and review the complete historical record of security issues associated with this product. By centralizing these findings, the page serves as a critical reference for developers and security analysts aiming to assess risk, plan necessary patches, and maintain the integrity of their Ruby-based web infrastructure. The data presented here is strictly factual and derived from public vulnerability databases to ensure accuracy without promotional bias. Users seeking to harden their deployments will find detailed descriptions of affected versions and recommended mitigation strategies directly linked to each entry. This aggregation supports proactive security management by providing a clear timeline of when specific issues were disclosed and resolved.

Vendor: Rack

CVE ID Title CVSS Severity Published
CVE-2026-26962 Rack: Header injection in multipart requests CWE-93 4.8 Medium 2026-04-02
CVE-2026-34835 Rack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass. CWE-1286 4.8 Medium 2026-04-02
CVE-2026-34827 Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser CWE-407 7.5 High 2026-04-02
CVE-2026-32762 Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing CWE-436 4.8 Medium 2026-04-02
CVE-2026-34830 Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginx CWE-625 5.9 Medium 2026-04-02
CVE-2026-34829 Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length CWE-400 7.5 High 2026-04-02
CVE-2026-34826 Rack: Unbounded Range Count in get_byte_ranges Enables DoS CWE-400 5.3 Medium 2026-04-02
CVE-2026-34786 Rack: Rack::Static header_rules bypass via URL-encoded paths CWE-180 5.3 Medium 2026-04-02
CVE-2026-34785 Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching CWE-187 7.5 High 2026-04-02
CVE-2026-34763 Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation CWE-625 5.3 Medium 2026-04-02
CVE-2026-34831 Rack: Content-Length mismatch in Rack::Files error responses CWE-130 4.8 Medium 2026-04-02
CVE-2026-26961 Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypass CWE-436 3.7 Low 2026-04-02
CVE-2026-34230 Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header CWE-400 5.3 Medium 2026-04-02
CVE-2026-25500 Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href CWE-79 5.4 Medium 2026-02-18
CVE-2026-22860 Rack has a Directory Traversal via Rack:Directory CWE-22 7.5 High 2026-02-18
CVE-2025-61919 Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing CWE-400 7.5 High 2025-10-10
CVE-2025-61780 Rack has Possible Information Disclosure Vulnerability CWE-200 5.8 Medium 2025-10-10
CVE-2025-61772 Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) CWE-400 7.5 High 2025-10-07
CVE-2025-61771 Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) CWE-400 7.5 High 2025-10-07
CVE-2025-61770 Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) CWE-400 7.5 High 2025-10-07
CVE-2025-59830 Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters CWE-400 7.5 High 2025-09-25
CVE-2025-49007 ReDoS Vulnerability in Rack::Multipart handle_mime_head CWE-770 7.5AI High AI 2025-06-04
CVE-2025-46727 Unbounded-Parameter DoS in Rack::QueryParser CWE-400 7.5 High 2025-05-07
CVE-2025-32441 Rack session gets restored after deletion CWE-362 4.2 Medium 2025-05-07
CVE-2025-27610 Local File Inclusion in Rack::Static CWE-23 7.5 High 2025-03-10
CVE-2025-27111 Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection CWE-93 5.3 - 2025-03-04
CVE-2025-25184 Possible Log Injection in Rack::CommonLogger CWE-93 4.3 - 2025-02-12
CVE-2023-27539 Rack 安全漏洞 7.5 - 2025-01-09
CVE-2024-39316 Rack ReDoS Vulnerability in HTTP Accept Headers Parsing CWE-1333 6.5 Medium 2024-07-02
CVE-2024-26141 Possible DoS Vulnerability with Range Header in Rack CWE-400 5.8 Medium 2024-02-28

All 35 known CVE vulnerabilities affecting Rack with full Chinese analysis, references, and POCs where available.