TI-2024-16580 CVE-2024-25126 · GHSA-22f2-v57c-j9cx
Rack ReDos in content type parsing (2nd degree polynomial)
Priority HIGH 72
Rack is a modular Ruby web server interface.
rack
Records42All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high23CVSS 7.0–8.9
Exploited now
rack records in CISA KEVNo rack vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
37 records in Rack · all components
TI-2024-17236 CVE-2024-26146 · GHSA-54rr-7fvw-6x8f
Possible Denial of Service Vulnerability in Rack Header Parsing
Priority MEDIUM 43
Rack is a modular Ruby web server interface.
TI-2024-17231 CVE-2024-26141 · GHSA-xj5v-6v4g-jfw6
Possible DoS Vulnerability with Range Header in Rack
Priority MEDIUM 42
Rack is a modular Ruby web server interface.
TI-2023-12254 CVE-2023-27530 · GHSA-3h57-hmj3-gj3p
Uncontrolled resource consumption in https://github.com/rack/rack
Priority MEDIUM 42
A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing t…
TI-2025-38165 CVE-2025-61772 · GHSA-wpv5-97wm-hp9c
Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
Priority MEDIUM 41
Rack is a modular Ruby web server interface.
TI-2025-38163 CVE-2025-61770 · GHSA-p543-xpfm-54cp
Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)
Priority MEDIUM 41
Rack is a modular Ruby web server interface.
TI-2025-29398 CVE-2025-46727 · GHSA-gjh7-p2fx-99vx
Unbounded-Parameter DoS in Rack::QueryParser
Priority MEDIUM 41
Rack is a modular Ruby web server interface.
TI-2025-20419 CVE-2025-27610 · GHSA-7wqh-767x-r66v
Local File Inclusion in Rack::Static
Priority MEDIUM 41
Rack provides an interface for developing web applications in Ruby.
TI-2026-18352 CVE-2026-22860 · GHSA-mxw3-3hh2-x2mh
Rack has a Directory Traversal via Rack:Directory
Priority MEDIUM 40
Rack is a modular Ruby web server interface.
TI-2025-38164 CVE-2025-61771 · GHSA-w9pc-fmgc-vxvw
Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
Priority MEDIUM 40
Rack is a modular Ruby web server interface.
TI-2025-37269 CVE-2025-59830 · GHSA-625h-95r8-8xpm
Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters
Priority MEDIUM 40
Rack is a modular Ruby web server interface.
TI-2026-27073 CVE-2026-34829 · GHSA-8vqr-qjwx-82mw
Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length
Priority LOW 39
Rack is a modular Ruby web server interface.
TI-2026-27071 CVE-2026-34827 · GHSA-v6x5-cg8r-vv6x
Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser
Priority LOW 39
Rack is a modular Ruby web server interface.
TI-2026-27070 CVE-2026-34826 · GHSA-x8cg-fq8g-mxfx
Rack: Unbounded Range Count in get_byte_ranges Enables DoS
Priority LOW 39
Rack is a modular Ruby web server interface.
TI-2026-27029 CVE-2026-34785 · GHSA-h2jq-g4cq-5ppq
Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching
Priority LOW 39
Rack is a modular Ruby web server interface.
TI-2026-26525 CVE-2026-34230 · GHSA-v569-hp3g-36wr
Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header
Priority LOW 39
Rack is a modular Ruby web server interface.
TI-2025-19981 CVE-2025-27111 · GHSA-8cgq-6mh2-7j6v
Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection
Priority LOW 38
Rack is a modular Ruby web server interface.
TI-2025-31135 CVE-2025-49007 · GHSA-47m2-26rw-j2jw
ReDoS Vulnerability in Rack::Multipart handle_mime_head
Priority LOW 36
Rack is a modular Ruby web server interface.
TI-2022-21912 CVE-2022-44572 · GHSA-rqv2-275x-2jq5
Uncontrolled resource consumption in https://github.com/rack/rack
Priority LOW 36
A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack…
TI-2022-21911 CVE-2022-44571 · GHSA-93pm-5p5f-3ghx
Uncontrolled resource consumption in https://github.com/rack/rack
Priority LOW 36
There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1.
TI-2022-21910 CVE-2022-44570 · GHSA-65f5-mfpf-vfhj
Uncontrolled resource consumption in https://github.com/rack/rack
Priority LOW 36
A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0.
TI-2025-38268 CVE-2025-61919 · GHSA-6xw4-3v39-52mm
Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing
Priority LOW 34
Rack is a modular Ruby web server interface.
TI-2019-12562 CVE-2019-16782 · GHSA-hrqr-hxpp-chr3
Possible Information Leak / Session Hijack Vulnerability in Rack
Priority LOW 34
There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack).
TI-2025-38173 CVE-2025-61780 · GHSA-r657-rxjc-j557
Rack has Possible Information Disclosure Vulnerability
Priority LOW 33
Rack is a modular Ruby web server interface.
TI-2026-27074 CVE-2026-34830 · GHSA-qv7j-4883-hwh7
Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginx
Priority LOW 32
Rack is a modular Ruby web server interface.