51 Total advisories
51 Vulnerabilities
0 Malware
Vulnerabilities
MEDIUM 4.8
CVE-2026-32762
Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing
MEDIUM 4.8
CVE-2026-34835
Rack::Request accepts invalid Host characters, enabling host allowlist bypass
MEDIUM 4.8
CVE-2026-34831
Rack has Content-Length mismatch in Rack::Files error responses
MEDIUM 4.8
CVE-2026-26962
Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values
MEDIUM 5.9
CVE-2026-34830
Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect
HIGH 7.5
CVE-2026-34230
Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header
HIGH 7.5
CVE-2026-34829
Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads
MEDIUM 5.3
CVE-2026-26961
Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass.
MEDIUM 5.3
CVE-2026-34763
Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory
HIGH 7.5
CVE-2026-34827
Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters
MEDIUM 5.3
CVE-2026-34826
Rack's multipart byte range processing allows denial of service via excessive overlapping ranges
MEDIUM 5.3
CVE-2026-34786
Rack:: Static header_rules bypass via URL-encoded paths
HIGH 7.5
CVE-2026-34785
Rack::Static prefix matching can expose unintended files under the static root
MEDIUM 4.2
CVE-2025-32441
Rack session gets restored after deletion
HIGH 7.5
CVE-2025-59830
Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters
MEDIUM 6.3
CVE-2019-16782
Possible Information Leak / Session Hijack Vulnerability in Rack
MEDIUM 5.4
CVE-2026-25500
Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href
HIGH 7.5
CVE-2026-22860
Rack has a Directory Traversal via Rack:Directory
HIGH 7.5
CVE-2025-61771
Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
HIGH 7.5
CVE-2025-61919
Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing
UNKNOWN
CVE-2025-27111
Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection
MEDIUM 5.8
CVE-2025-61780
Rack has a Possible Information Disclosure Vulnerability
HIGH 7.5
CVE-2025-61772
Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
HIGH 7.5
CVE-2025-46727
Rack has an Unbounded-Parameter DoS in Rack::QueryParser
MEDIUM 5.3
CVE-2024-25126
Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)
UNKNOWN
CVE-2024-26141
Rack has possible DoS Vulnerability with Range Header
HIGH 7.5
CVE-2025-27610
Local File Inclusion in Rack::Static
MEDIUM 6.5
CVE-2024-39316
Rack ReDoS Vulnerability in HTTP Accept Headers Parsing
MEDIUM 6.5
CVE-2025-25184
Possible Log Injection in Rack::CommonLogger
UNKNOWN
CVE-2024-26146
Rack Header Parsing leads to Possible Denial of Service Vulnerability
HIGH 7.5
CVE-2025-61770
Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)
UNKNOWN
CVE-2025-49007
ReDoS Vulnerability in Rack::Multipart handle_mime_head
HIGH 7.5
CVE-2022-44570
Denial of service via header parsing in Rack
HIGH 7.5
CVE-2023-27530
Rack has possible DoS Vulnerability in Multipart MIME parsing
UNKNOWN
CVE-2023-27539
Possible Denial of Service Vulnerability in Rack's header parsing
UNKNOWN
CVE-2013-0184
Rack vulnerable to Denial of Service
UNKNOWN
CVE-2013-0263
Rack arbitrary code execution via timing attack
UNKNOWN
CVE-2013-0183
Rack rubygems receiving excessively long lines triggers out-of-memory error
UNKNOWN
CVE-2015-3225
Rack vulnerable to Denial of Service via large parameter depth request
UNKNOWN
GHSA-9vc2-p34x-jhxh
Moderate severity vulnerability that affects rack
UNKNOWN
CVE-2022-44572
Denial of service via multipart parsing in Rack
UNKNOWN
CVE-2022-44571
Denial of Service Vulnerability in Rack Content-Disposition parsing
UNKNOWN
CVE-2011-5036
Rack Gem Subject to Denial of Service via Hash Collisions
UNKNOWN
CVE-2012-6109
Rack vulnerable to REDoS
UNKNOWN
CVE-2013-0262
Rack Vulnerable to Path Traversal
HIGH 8.6
CVE-2020-8161
Directory traversal in Rack::Directory app bundled with Rack
CRITICAL 10.0
CVE-2022-30123
Possible shell escape sequence injection vulnerability in Rack
HIGH 7.5
CVE-2022-30122
Denial of Service Vulnerability in Rack Multipart Parsing
MEDIUM 6.1
CVE-2018-16471
Rack vulnerable to Cross-site Scripting
HIGH 7.5
CVE-2020-8184
Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names
HIGH 7.5
CVE-2018-16470
Rack vulnerable to Denial of Service
Ready to move
Start Securing
Free, no credit card | First findings in minutes