2651 matches found
rack-bug
Rack::Bug Code Climate Repository: http://github.com/brynary/rack-bug Description Rack::Bug adds a diagnostics toolbar to Rack apps. When enabled, it injects a floating div allowing exploration of logging, database queries, template rendering times, etc. Features Password-based security IP-based...
CVE-2026-126073
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but...
CVE-2026-125108
A flaw was found in Rack. When parsing multipart requests, Rack can skip an invalid or empty leading boundary parameter in the Content-Type header and process a subsequent boundary instead. A remote attacker can exploit this issue by sending specially crafted multipart requests that intermediate...
CVE-2026-125109
A flaw was found in Rack. A remote attacker can exploit this vulnerability by sending HTTP requests with specially crafted host headers containing invalid characters. Because the interface returns unvalidated host data when authority validation fails, applications relying on it to construct URLs...
CVE-2026-125110
A flaw was found in Rack. An unauthenticated remote attacker can bypass path-specific security headers by requesting files using paths containing raw or percent-encoded dot segments. This issue occurs because the static file serving component normalizes paths when locating files but evaluates...
Action Pack: Possible cache poisoning in Action Pack content negotiation
Impact Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but ActionController::Renderingsetvaryheader adds Vary: Accept only when the request carries a usable Accept header and the respons...
GHSA-R9JG-FMFX-2GV6 Action Pack: Possible cache poisoning in Action Pack content negotiation
Impact Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but ActionController::Renderingsetvaryheader adds Vary: Accept only when the request carries a usable Accept header and the respons...
CVE-2026-126083
Action Pack is a framework for handling and responding to web requests. From 8.1 until 8.1.4.1, Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remoteip from Rack::Requestforwardedfor, which under Rack 3 reads the RFC 7239 Forwarded header in preference to X-Forwarded-For. When a...
DEBIAN-CVE-2026-126073
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but...
CVE-2026-126073
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but...
EUVD-2026-122936
Action Pack is a framework for handling and responding to web requests. From 8.1 until 8.1.4.1, Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remoteip from Rack::Requestforwardedfor, which under Rack 3 reads the RFC 7239 Forwarded header in preference to X-Forwarded-For. When a...
CVE-2026-126083 Action Pack: Possible IP spoofing in Action Dispatch RemoteIp
Action Pack is a framework for handling and responding to web requests. From 8.1 until 8.1.4.1, Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remoteip from Rack::Requestforwardedfor, which under Rack 3 reads the RFC 7239 Forwarded header in preference to X-Forwarded-For. When a...
CVE-2026-126073 Action Pack: Possible cache poisoning in Action Pack content negotiation
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but...
CVE-2026-126073
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but...
EUVD-2026-123003
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but...
Rack: Multipart parsing allows DoS via unbounded scan buffer growth
Summary Rack::Multipart::Parser reads the request body in chunks of rack.multipart.buffersize 1 MiB by default into an internal scan buffer. Parsed bytes are only discarded from that buffer when a chunk ends inside a part body. A request whose parts are sized so that every chunk ends inside, or...
EUVD-2026-120485
Rack: Multipart parsing allows DoS via unbounded scan buffer growth...
GHSA-5V64-555J-WJXM Rack: Multipart parsing allows DoS via unbounded scan buffer growth
Summary Rack::Multipart::Parser reads the request body in chunks of rack.multipart.buffersize 1 MiB by default into an internal scan buffer. Parsed bytes are only discarded from that buffer when a chunk ends inside a part body. A request whose parts are sized so that every chunk ends inside, or...
Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass
Summary The guard added for CVE-2026-26961 GHSA-vgpv-f759-9wx3, which rejects multipart requests with more than one boundary parameter, only inspects the part of the Content-Type header after the boundary it extracts. A Content-Type whose first boundary parameter is empty or begins with a quote,...