rack

Records42All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high23CVSS 7.0–8.9

Exploited now

rack records in CISA KEV

No rack vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Rack 37 records HIGH Rack-session 1 record MEDIUM

Records

42 records

TI-2024-23301 CVE-2024-35231 · GHSA-8c8q-2xw3-j869

rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter

HIGH 76

rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00668 Published 2024-05-27 Fixed in 2.5.0 CWE-770

TI-2024-16580 CVE-2024-25126 · GHSA-22f2-v57c-j9cx

Rack ReDos in content type parsing (2nd degree polynomial)

HIGH 72

Rack is a modular Ruby web server interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.35376 Published 2024-02-28 Partial fix · 3.0.9.1, 2.2.8.1 CWE-1333

TI-2026-28312 CVE-2026-39324 · GHSA-33qg-7wpp-89cq

Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization

MEDIUM 48

Rack::Session is a session management implementation for Rack.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00274 Published 2026-04-07 Fixed in 2.1.2 CWE-287

TI-2024-17236 CVE-2024-26146 · GHSA-54rr-7fvw-6x8f

Possible Denial of Service Vulnerability in Rack Header Parsing

MEDIUM 43

Rack is a modular Ruby web server interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01996 Published 2024-02-28 Partial fix · 3.0.9.1, 2.2.8.1 +2 CWE-1333

TI-2024-17231 CVE-2024-26141 · GHSA-xj5v-6v4g-jfw6

Possible DoS Vulnerability with Range Header in Rack

MEDIUM 42

Rack is a modular Ruby web server interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01612 Published 2024-02-28 Partial fix · 3.0.9.1, 2.2.8.1 CWE-400

TI-2023-12254 CVE-2023-27530 · GHSA-3h57-hmj3-gj3p

Uncontrolled resource consumption in https://github.com/rack/rack

MEDIUM 42

A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing t…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0183 Published 2023-03-10 Partial fix · 2.0.9.3, 2.1.4.3 +2 CWE-400

TI-2025-38165 CVE-2025-61772 · GHSA-wpv5-97wm-hp9c

Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

MEDIUM 41

Rack is a modular Ruby web server interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0093 Published 2025-10-07 Partial fix · 2.2.19, 3.1.17 +1 CWE-400

TI-2025-38163 CVE-2025-61770 · GHSA-p543-xpfm-54cp

Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)

MEDIUM 41

Rack is a modular Ruby web server interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0093 Published 2025-10-07 Partial fix · 2.2.19, 3.1.17 +1 CWE-400

TI-2025-29398 CVE-2025-46727 · GHSA-gjh7-p2fx-99vx

Unbounded-Parameter DoS in Rack::QueryParser

MEDIUM 41

Rack is a modular Ruby web server interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01228 Published 2025-05-07 Partial fix · 2.2.14, 3.0.16 +1 CWE-400

TI-2025-20419 CVE-2025-27610 · GHSA-7wqh-767x-r66v

Local File Inclusion in Rack::Static

MEDIUM 41

Rack provides an interface for developing web applications in Ruby.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01173 Published 2025-03-10 Partial fix · 2.2.13, 3.0.14 +1 CWE-23

TI-2026-18352 CVE-2026-22860 · GHSA-mxw3-3hh2-x2mh

Rack has a Directory Traversal via Rack:Directory

MEDIUM 40

Rack is a modular Ruby web server interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00763 Published 2026-02-18 Partial fix · 2.2.22, 3.1.20 +1 CWE-22

TI-2025-38164 CVE-2025-61771 · GHSA-w9pc-fmgc-vxvw

Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

MEDIUM 40

Rack is a modular Ruby web server interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00561 Published 2025-10-07 Partial fix · 2.2.19, 3.1.17 +1 CWE-400

TI-2025-37269 CVE-2025-59830 · GHSA-625h-95r8-8xpm

Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters

MEDIUM 40

Rack is a modular Ruby web server interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00573 Published 2025-09-25 Partial fix · 2.2.18 CWE-400

TI-2026-27073 CVE-2026-34829 · GHSA-8vqr-qjwx-82mw

Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length

LOW 39

Rack is a modular Ruby web server interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00375 Published 2026-04-02 Partial fix · 2.2.23, 3.1.21 +1 CWE-400

TI-2026-27071 CVE-2026-34827 · GHSA-v6x5-cg8r-vv6x

Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser

LOW 39

Rack is a modular Ruby web server interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00494 Published 2026-04-02 Partial fix · 3.1.21, 3.2.6 CWE-400

TI-2026-27070 CVE-2026-34826 · GHSA-x8cg-fq8g-mxfx

Rack: Unbounded Range Count in get_byte_ranges Enables DoS

LOW 39

Rack is a modular Ruby web server interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00395 Published 2026-04-02 Partial fix · 2.2.23, 3.1.21 +1 CWE-400

TI-2026-27029 CVE-2026-34785 · GHSA-h2jq-g4cq-5ppq

Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching

LOW 39

Rack is a modular Ruby web server interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00394 Published 2026-04-02 Fixed in 2.2.23, 3.1.21 +1 CWE-187

TI-2026-26525 CVE-2026-34230 · GHSA-v569-hp3g-36wr

Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header

LOW 39

Rack is a modular Ruby web server interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00447 Published 2026-04-02 Partial fix · 2.2.23, 3.1.21 +1 CWE-400

TI-2025-19981 CVE-2025-27111 · GHSA-8cgq-6mh2-7j6v

Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

LOW 38

Rack is a modular Ruby web server interface.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0075 Published 2025-03-04 Partial fix · 2.2.12, 3.0.13 +1 CWE-117

TI-2018-11812 CVE-2018-16470 · GHSA-hg78-4f6x-99wq

Uncontrolled resource consumption in Rack

LOW 37

There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02033 Published 2018-11-13 Partial fix · 2.0.6 CWE-400

TI-2025-31135 CVE-2025-49007 · GHSA-47m2-26rw-j2jw

ReDoS Vulnerability in Rack::Multipart handle_mime_head

LOW 36

Rack is a modular Ruby web server interface.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00584 Published 2025-06-04 Partial fix · 3.1.16 CWE-770

TI-2022-21912 CVE-2022-44572 · GHSA-rqv2-275x-2jq5

Uncontrolled resource consumption in https://github.com/rack/rack

LOW 36

A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01617 Published 2023-02-09 Fixed in 2.0.9.2, 2.1.4.2 +2 CWE-400

TI-2022-21911 CVE-2022-44571 · GHSA-93pm-5p5f-3ghx

Uncontrolled resource consumption in https://github.com/rack/rack

LOW 36

There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01503 Published 2023-02-09 Fixed in 2.0.9.2, 2.1.4.2 +2 CWE-400

TI-2022-21910 CVE-2022-44570 · GHSA-65f5-mfpf-vfhj

Uncontrolled resource consumption in https://github.com/rack/rack

LOW 36

A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01626 Published 2023-02-09 Fixed in 2.0.9.2, 2.1.4.2 +2 CWE-400

TI-2025-38268 CVE-2025-61919 · GHSA-6xw4-3v39-52mm

Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing

LOW 34

Rack is a modular Ruby web server interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00648 Published 2025-10-10 Partial fix · 2.2.20, 3.1.18 +1 CWE-400

Open these records in search →

Critical	1
High	23
Medium	18
Low	0
No CVSS	0