rack-bug

Rack::Bug Code Climate Repository: http://github.com/brynary/rack-bug Description Rack::Bug adds a diagnostics toolbar to Rack apps. When enabled, it injects a floating div allowing exploration of logging, database queries, template rendering times, etc. Features Password-based security IP-based...

GHSA-5V64-555J-WJXM vulnerabilities

Vulnerabilities for packages: ruby3.3-rack, ruby3.4-rack, logstash, ruby4.0-rack...

GHSA-WVG4-6P58-3GH3 vulnerabilities

Vulnerabilities for packages: ruby3.3-rack, ruby3.4-rack, logstash, ruby4.0-rack...

CVE-2026-125110 vulnerabilities

Vulnerabilities for packages: ruby3.3-rack, ruby3.4-rack, logstash, ruby4.0-rack...

CVE-2026-125111 vulnerabilities

Vulnerabilities for packages: ruby3.3-rack, ruby3.4-rack, logstash, ruby4.0-rack...

GHSA-P8X9-V4HV-2W4G vulnerabilities

Vulnerabilities for packages: ruby3.3-rack, ruby3.4-rack, logstash, ruby4.0-rack...

CVE-2026-125108 vulnerabilities

Vulnerabilities for packages: ruby3.3-rack, ruby3.4-rack, logstash, ruby4.0-rack...

CVE-2026-39324

CVE-2026-39324 Exploit PoC Rack::Session::Cookie decrypt failure falls back to accepting unencrypted cookies | ---|--- Advisory| GHSA-33qg-7wpp-89cq Package| rack-session RubyGems Affected| = 2.1.1 Patched| 2.1.2 Summary Rack::Session::Cookie with secrets: should only accept encrypted cookies. Bu...

CVE-2026-125108

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parseboundary can skip a leading empty or quoted boundary parameter in a multipart Content-Type header and accept a later parameter. Rack can therefore parse a request body with a boundary tha...

UBUNTU-CVE-2026-125108

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parseboundary can skip a leading empty or quoted boundary parameter in a multipart Content-Type header and accept a later parameter. Rack can therefore parse a request body with a boundary tha...

CVE-2026-126073

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but...

UBUNTU-CVE-2026-125109

Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Requesthostwithport, baseurl, and url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use thes...

CVE-2026-125109

Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Requesthostwithport, baseurl, and url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use thes...

CVE-2026-125110

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.cleanpathinfo normalization but evaluates headerrules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encode...

CVE-2026-125111

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can align many small parts with...

UBUNTU-CVE-2026-125110

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.cleanpathinfo normalization but evaluates headerrules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encode...

UBUNTU-CVE-2026-125111

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can align many small parts with...

CVE-2026-126073

Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but...

CVE-2026-125108

A flaw was found in Rack. When parsing multipart requests, Rack can skip an invalid or empty leading boundary parameter in the Content-Type header and process a subsequent boundary instead. A remote attacker can exploit this issue by sending specially crafted multipart requests that intermediate...

CVE-2026-125109

A flaw was found in Rack. A remote attacker can exploit this vulnerability by sending HTTP requests with specially crafted host headers containing invalid characters. Because the interface returns unvalidated host data when authority validation fails, applications relying on it to construct URLs...