rack-bug

Rack::Bug Code Climate Repository: http://github.com/brynary/rack-bug Description Rack::Bug adds a diagnostics toolbar to Rack apps. When enabled, it injects a floating div allowing exploration of logging, database queries, template rendering times, etc. Features Password-based security IP-based...

CVE-2026-34835-Black-box-Analysis

Este repositorio proporciona un análisis de seguridad de caja negra de CVE-2026-34835 desde la perspectiva de un probador de penetración externo. El objetivo no es realizar ingeniería inversa de la vulnerabilidad, sino documentar cómo un evaluador de seguridad puede identificar, validar y evaluar...

CVE-2026-39324

PoC de Explotación de CVE-2026-39324 El fallo de descifrado de Rack::Session::Cookie recurre a aceptar cookies sin cifrar | ---|--- Aviso| GHSA-33qg-7wpp-89cq Paquete| rack-session RubyGems Afectado| = 2.1.1 Corregido| 2.1.2 Resumen Rack::Session::Cookie con secrets: solo debería aceptar cookies...

Astra Linux – Vulnerability in Ruby-Rack

A sequence injection vulnerability exists in Rack versions 2.0.9.1, 2.1.4.1, and 2.2.3.1. This vulnerability could allow for shell escapes in the Lint and CommonLogger components of Rack...

Astra Linux – Vulnerability in Ruby-Rack

A denial-of-service vulnerability in the multipart parsing component of Rack was fixed in versions 2.0.9.2, 2.1.4.2, 2.2.4.1, and 3.0.0.1. This vulnerability could allow attackers to craft input that causes the RFC2183 multipart boundary parsing in Rack to take an unexpectedly long time,...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Carefully crafted headers may cause header parsing in Rack to take longer than expected, potentially leading to a denial-of-service issue. The Accept and Forwarded headers are affected. Ruby 3.2 includes fixes for this problem, so Rack applications tha...

Astra Linux – Vulnerability in Ruby-Rack

There is a denial-of-service vulnerability in the header parsing component of Rack...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the Rack::File middleware or the...

Astra Linux – Vulnerability in Ruby-Rack

There is a denial-of-service vulnerability in the Content-Disposition parsing component of Rack, which was fixed in versions 2.0.9.2, 2.1.4.2, 2.2.4.1, and 3.0.0.1. This vulnerability could allow an attacker to create an input that causes the Content-Disposition header parsing in Rack to take an...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitized header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences such as newline characters into the header, resulting in log injection. This vulnerability has been...

Astra Linux – Vulnerability in Ruby-Rack

A denial-of-service vulnerability exists in the Range header parsing component of Rack, version 1.5.0 and later. A carefully crafted input can cause the Range header parsing component in Rack to take an unexpectedly long time, potentially leading to a denial-of-service attack. Any applications th...

Astra Linux – Vulnerability in Ruby-Rack

There is a directory traversal vulnerability in Rack versions prior to 2.2.0. This vulnerability allows attackers to exploit the directory traversal vulnerability in the Rack::Directory module, which is included with Rack. This could lead to the disclosure of sensitive information...

Astra Linux – Vulnerability in Ruby-Rack

A security vulnerability exists in versions of Rack 2.2.3 and Rack 2.1.4, where reliance on cookies without validation/integrity checks allows an attacker to forge a secure or host-only cookie prefix...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial-of-service vulnerability ReDos, degree 2 polynomial. This vulnerability has been fixed in 3.0.9.1 and 2.2.8.1...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, “Rack::Multipart::Parser” stores non-file form fields fields without a filename entirely in memory as Ruby String objects. A single large text field in a multipart/form-data request hundreds of megabytes ...

Astra Linux – Vulnerability in Ruby-Rack

There is a DoS vulnerability in Rack versions v3.0.4.2, v2.2.6.3, v2.1.4.3, and v2.0.9.3, particularly in the Multipart MIME parsing code. This vulnerability could allow an attacker to craft requests that can be abused to cause the multipart parsing to take longer than expected...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. In versions 3.0.0.beta1 through 3.1.21, and from 3.2.0 through 3.2.6, Rack::Multipart::Parserhandlemimehead parsed quoted multipart parameters such as Content-Disposition: form-data; name="..." using repeated Stringindex searches combined with...

Astra Linux – Vulnerability in Puma

Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP requests comply with the RFC7230 standard, Puma and the frontend proxy may disagree about where the requests start and...

Astra Linux – Vulnerability in Ruby-Rack

There is a possible denial-of-service vulnerability in Rack versions 2.0.9.1, 2.1.4.1, and 2.2.3.1, specifically in the multipart parsing component of Rack...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wrapped the request body using BoundedIO when the CONTENTLENGTH header was present. When a multipart/form-data request was sent without a Content-Length header, such as with HTTP...