rubygems

rack

51 Total advisories

51 Vulnerabilities

0 Malware

Dependency scanning

Check whether rack is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

rack

Vulnerabilities

Rack's multipart byte range processing allows denial of service via excessive overlapping ranges

Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass.

Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values

Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header

Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect

Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing

Rack:: Static header_rules bypass via URL-encoded paths

Rack has Content-Length mismatch in Rack::Files error responses

Rack::Static prefix matching can expose unintended files under the static root

Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads

Rack has a Possible Information Disclosure Vulnerability

Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters

Rack has an Unbounded-Parameter DoS in Rack::QueryParser

Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters

Rack::Request accepts invalid Host characters, enabling host allowlist bypass

Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory

Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href

Rack has a Directory Traversal via Rack:Directory

Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)

Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing

ReDoS Vulnerability in Rack::Multipart handle_mime_head

Rack session gets restored after deletion

Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

Possible Log Injection in Rack::CommonLogger

Rack Header Parsing leads to Possible Denial of Service Vulnerability

Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)

Rack has possible DoS Vulnerability with Range Header

Local File Inclusion in Rack::Static

Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names

Possible Information Leak / Session Hijack Vulnerability in Rack

Directory traversal in Rack::Directory app bundled with Rack

Rack ReDoS Vulnerability in HTTP Accept Headers Parsing

Denial of service via header parsing in Rack

Rack has possible DoS Vulnerability in Multipart MIME parsing

Possible Denial of Service Vulnerability in Rack's header parsing

Rack vulnerable to Denial of Service

Rack arbitrary code execution via timing attack

Rack rubygems receiving excessively long lines triggers out-of-memory error

Rack vulnerable to Denial of Service via large parameter depth request

Moderate severity vulnerability that affects rack

Denial of service via multipart parsing in Rack

Denial of Service Vulnerability in Rack Content-Disposition parsing

Rack Gem Subject to Denial of Service via Hash Collisions

Rack vulnerable to REDoS

Rack Vulnerable to Path Traversal

Possible shell escape sequence injection vulnerability in Rack

Denial of Service Vulnerability in Rack Multipart Parsing

Rack vulnerable to Cross-site Scripting

Rack vulnerable to Denial of Service

Browse more RubyGems advisories

Start Securing