Astra Linux – Vulnerability in Ruby-Rack

There is a denial-of-service vulnerability in the header parsing component of Rack...

Astra Linux – Vulnerability in Ruby-Rack

There is a directory traversal vulnerability in Rack versions prior to 2.2.0. This vulnerability allows attackers to exploit the directory traversal vulnerability in the Rack::Directory module, which is included with Rack. This could lead to the disclosure of sensitive information...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial-of-service vulnerability ReDos, degree 2 polynomial. This vulnerability has been fixed in 3.0.9.1 and 2.2.8.1...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. In versions 3.0.0.beta1 through 3.1.21, and from 3.2.0 through 3.2.6, Rack::Multipart::Parserhandlemimehead parsed quoted multipart parameters such as Content-Disposition: form-data; name="..." using repeated Stringindex searches combined with...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Before versions 2.2.20, 3.1.18, and 3.2.3, Rack::RequestPOST would read the entire request body into memory when the Content-Type was application/x-www-form-urlencoded. This action did not enforce any length or capacity limits on the input. As a result...

Astra Linux – Vulnerability in Ruby-Rack

A sequence injection vulnerability exists in Rack versions 2.0.9.1, 2.1.4.1, and 2.2.3.1. This vulnerability could allow for shell escapes in the Lint and CommonLogger components of Rack...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static used a simple string prefix check to determine whether a request should be treated as a static file. When configured with URL prefixes like "/css", it matched any request path that began with th...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wrapped the request body using BoundedIO when the CONTENTLENGTH header was present. When a multipart/form-data request was sent without a Content-Length header, such as with HTTP...

Astra Linux – Vulnerability in Ruby-Rack

There is a denial-of-service vulnerability in the Content-Disposition parsing component of Rack, which was fixed in versions 2.0.9.2, 2.1.4.2, 2.2.4.1, and 3.0.0.1. This vulnerability could allow an attacker to create an input that causes the Content-Disposition header parsing in Rack to take an...

Astra Linux – Vulnerability in Ruby-Rack

A denial-of-service vulnerability exists in the Range header parsing component of Rack, version 1.5.0 and later. A carefully crafted input can cause the Range header parsing component in Rack to take an unexpectedly long time, potentially leading to a denial-of-service attack. Any applications th...

Astra Linux – Vulnerability in Ruby-Rack

A denial-of-service vulnerability in the multipart parsing component of Rack was fixed in versions 2.0.9.2, 2.1.4.2, 2.2.4.1, and 3.0.0.1. This vulnerability could allow attackers to craft input that causes the RFC2183 multipart boundary parsing in Rack to take an unexpectedly long time,...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the Rack::File middleware or the...

Astra Linux – Vulnerability in Ruby-Rack

There is a DoS vulnerability in Rack versions v3.0.4.2, v2.2.6.3, v2.1.4.3, and v2.0.9.3, particularly in the Multipart MIME parsing code. This vulnerability could allow an attacker to craft requests that can be abused to cause the multipart parsing to take longer than expected...

Astra Linux – Vulnerability in Puma

Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP requests comply with the RFC7230 standard, Puma and the frontend proxy may disagree about where the requests start and...

Astra Linux – Vulnerability in Ruby-Rack

A security vulnerability exists in versions of Rack 2.2.3 and Rack 2.1.4, where reliance on cookies without validation/integrity checks allows an attacker to forge a secure or host-only cookie prefix...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, Rack::Directory generated an HTML directory index where each file entry was rendered as a clickable link. If a file existed on the disk whose basename started with “javascript:”, such as “javascript:alert1”,...

[SECURITY] [DSA 6492-1] ruby-rack security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6492-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 10, 2026 https://www.debian.org/security/faq -...

Debian dsa-6492 : ruby-rack - security update

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6492 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6492-1 [email protected] https://www.debian.org/securit...

openSUSE 16: ansible-rmt-server / rmt-server / rmt-server-config / etc (openSUSE-SU-2026:21640-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21640-1 advisory. Update to version 3.1 bsc1274715. Security issues fixed: - CVE-2026-26961: rack: greedy multipart boundary parsing can lead to parser...

OPENSUSE-SU-2026:21640-1 Security update for rmt-server

This update for rmt-server fixes the following issues: Update to version 3.1 bsc1274715. Security issues fixed: - CVE-2026-26961: rack: greedy multipart boundary parsing can lead to parser differentials and WAF bypass bsc1261398. - CVE-2026-26962: rack: improper unfolding of folded multipart...