PT-2026-29844

Name of the Vulnerable Software and Affected Versions Rack versions 3.0.0.beta1 through 3.1.20 and 3.2.0 through 3.2.5 Description The Rack web server interface is susceptible to a header parsing issue within Rack::Utils.forwarded values. The component incorrectly parses the RFC 7239 Forwarded...

Rack 安全漏洞

Rack is a modular Ruby web server interface developed by Rack authors. Versions of Rack prior to 3.1.21 and 3.2.6 contained security vulnerabilities. These vulnerabilities stemmed from improper handling of multi-part parameters with quotes during the parsing of...

CVE-2026-34785: Partial String Comparison

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as "/css", it matches any request path that begins with...

CVE-2026-34786: Incorrect Behavior Order: Validate Before Canonicalize

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Staticapplicablerules evaluates several headerrules types against the raw URL-encoded PATHINFO, while the underlying file-serving path is decoded before the file is served. As a result, a request for a...

PT-2026-29857

Rack versions 3.0.0.beta1 through 3.1.21, and 3.2.0 through 3.2.6 are affected by an issue where the Rack::Request component improperly parses the Host header, accepting characters not permitted in RFC-compliant hostnames such as /, ?, , and @. This can lead to host header poisoning in applicatio...

PT-2026-29910

Summary Rack::Multipart::Parser only wraps the request body in a BoundedIO when CONTENT LENGTH is present. When a multipart/form-data request is sent without a Content-Length header, such as with HTTP chunked transfer encoding, multipart parsing continues until end-of-stream with no total size...

PT-2026-29808

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.23, 3.1.21, and 3.2.6 Description Rack’s Rack::Multipart::Parser uses a greedy regular expression to extract the boundary parameter from multipart/form-data. When a Content-Type header contains multiple boundary...

Rack 安全漏洞

Rack is a modular Ruby web server interface developed by Rack authors. Vulnerabilities exist in versions of Rack prior to 2.2.23, 3.1.21, and 3.2.6. These vulnerabilities stem from Rack::Multipart::Parser, which handles multipart requests without a limit on the total size, potentially leading to...

CVE-2026-34826: Uncontrolled Resource Consumption

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.getbyteranges parses the HTTP Range header without limiting the number of individual byte ranges. Although the existing fix for CVE-2024-26141 rejects ranges whose total byte coverage exceeds the...

CVE-2026-26961: Interpretation Conflict

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one...

PT-2026-29918

Summary Rack::Filesfail sets the Content-Length response header using Stringsize instead of Stringbytesize. When the response body contains multibyte UTF-8 characters, the declared Content-Length is smaller than the number of bytes actually sent on the wire. Because Rack::Files reflects the...

PT-2026-29913

Summary Rack::Request parses the Host header using an AUTHORITY regular expression that accepts characters not permitted in RFC-compliant hostnames, including /, ?, , and @. Because req.host returns the full parsed value, applications that validate hosts using naive prefix or suffix checks can be...

CVE-2026-34835: Improper Validation of Syntactic Correctness of Input

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host header using an AUTHORITY regular expression that accepts characters not permitted in RFC-compliant hostnames, including /, ?, , and @. Because req.hos...

PT-2026-29915

Summary Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as "/css", it matches any request path that begins with that string, including unrelated paths such as "/css-config.env" or...

Rack 信息泄露漏洞

Rack is a modular Ruby web server interface developed by Rack authors. Versions of Rack prior to 2.2.23, 3.1.21, and 3.2.6 contained an information leakage vulnerability. This vulnerability stemmed from Rack::Static’s use of simple string prefix checks to determine whether a request should be...

Rack 安全漏洞

Rack is a modular Ruby web server interface developed by Rack authors. Versions of Rack prior to 3.1.21 and 3.2.6 contained security vulnerabilities. These vulnerabilities stemmed from the use of the AUTHORITY regular expression for parsing Host headers in Rack::Request, allowing illegal characte...

CVE-2026-34830: Permissive Regular Expression

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfilemapaccelpath interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is not...

Rack 安全漏洞

Rack is a modular Ruby web server interface developed by Rack authors. There were security vulnerabilities in versions of Rack from 3.0.0.beta1 to 3.1.21, as well as in versions from 3.2.0 to 3.2.6. These vulnerabilities stemmed from improper parsing of forwarded headers, which could lead to...

PT-2026-29819

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.23, 3.1.21, and 3.2.6 Description Rack’s Rack::Filesfail function incorrectly calculates the Content-Length response header using Stringsize instead of Stringbytesize. This occurs when the response body contains...

PT-2026-29922

Summary Rack::Sendfilemap accel path interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is not escaped, an attacker who can supply X-Accel-Mapping to the backend can inject regex...