Debian Ruby-Rack vulnerabilities

CVE-2024-26141 [MEDIUM] CVE-2024-26141: ruby-rack - Rack is a modular Ruby web server interface. Carefully crafted Range headers can... Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The

CVE-2024-26146 [MEDIUM] CVE-2024-26146: ruby-rack - Rack is a modular Ruby web server interface. Carefully crafted headers can cause... Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.

CVE-2022-44570 [HIGH] CVE-2022-44570: ruby-rack - A denial of service vulnerability in the Range header parsing component of Rack ... A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that s

CVE-2022-44572 [HIGH] CVE-2022-44572: ruby-rack - A denial of service vulnerability in the multipart parsing component of Rack fix... A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using R

CVE-2025-25184 [MEDIUM] CVE-2025-25184: ruby-rack - Rack provides an interface for developing web applications in Ruby. Prior to ver... Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. When a user provides the authorization credentials via

CVE-2022-44571 [HIGH] CVE-2022-44571: ruby-rack - There is a denial of service vulnerability in the Content-Disposition parsingcom... There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an attacker to craft an input that can cause Content-Disposition header parsing in Rackto take an unexpected amount of time, possibly resulting in a denial ofservice attack vector. This header is used typicall

CVE-2013-0263 [MEDIUM] CVE-2013-0263: ruby-rack - Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x befo... Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time. Scope: local bookworm: resolved (fixed in

CVE-2026-34831 [MEDIUM] CVE-2026-34831: ruby-rack - Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, a... Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Files#fail sets the Content-Length response header using String#size instead of String#bytesize. When the response body contains multibyte UTF-8 characters, the declared Content-Length is smaller than the number of bytes actually sent on the wire. Because Rack::Files

CVE-2022-30122 [HIGH] CVE-2022-30122: ruby-rack - A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and... A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack. Scope: local bookworm: resolved (fixed in 2.2.4-1) bullseye: resolved (fixed in 2.1.4-3+deb11u1) forky: resolved (fixed in 2.2.4-1) sid: resolved (fixed in 2.2.4-1) trixie: resolved (fixed in 2.2.4-1)

CVE-2026-34835 [MEDIUM] CVE-2026-34835: ruby-rack - Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before... Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host header using an AUTHORITY regular expression that accepts characters not permitted in RFC-compliant hostnames, including /, ?, #, and @. Because req.host returns the full parsed value, applications that validate hosts

CVE-2026-26962 [MEDIUM] CVE-2026-26962: ruby-rack - Rack is a modular Ruby web server interface. From version 3.2.0 to before versio... Rack is a modular Ruby web server interface. From version 3.2.0 to before version 3.2.6, Rack::Multipart::Parser unfolds folded multipart part headers incorrectly. When a multipart header contains an obs-fold sequence, Rack preserves the embedded CRLF in parsed parameter values such as filename or name instead of removing the folded line break during unfolding.

CVE-2026-32762 [MEDIUM] CVE-2026-32762: ruby-rack - Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before... Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21 and 3.2.0 to before 3.2.6, Rack::Utils.forwarded_values parses the RFC 7239 Forwarded header by splitting on semicolons before handling quoted-string values. Because quoted values may legally contain semicolons, a header can be interpreted by Rack as multiple Forwarded direct

CVE-2019-16782 [MEDIUM] CVE-2019-16782: ruby-rack - There's a possible information leak / session hijack vulnerability in Rack (Ruby... There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of

CVE-2025-61780 [MEDIUM] CVE-2025-61780: ruby-rack - Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, a... Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, a possible information disclosure vulnerability existed in `Rack::Sendfile` when running behind a proxy that supports `x-sendfile` headers (such as Nginx). Specially crafted headers could cause `Rack::Sendfile` to miscommunicate with the proxy and trigger unintended interna

CVE-2026-34763 [MEDIUM] CVE-2026-34763: ruby-rack - Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, a... Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Directory interpolates the configured root path directly into a regular expression when deriving the displayed directory path. If root contains regex metacharacters such as +, *, or ., the prefix stripping can fail and the generated directory listing may expose the fu

CVE-2026-34786 [MEDIUM] CVE-2026-34786: ruby-rack - Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, a... Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static#applicable_rules evaluates several header_rules types against the raw URL-encoded PATH_INFO, while the underlying file-serving path is decoded before the file is served. As a result, a request for a URL-encoded variant of a static path can serve the same file w

CVE-2026-26961 [LOW] CVE-2026-26961: ruby-rack - Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, a... Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, o

CVE-2015-3225 [MEDIUM] CVE-2015-3225: ruby-rack - lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby... lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth. Scope: local bookworm: resolved (fixed in 1.5.2-4) bullseye: resolved (fixed in 1.5.2-4) forky: resolved (fixed in 1.5.2-4) sid:

CVE-2026-25500 [MEDIUM] CVE-2026-25500: ruby-rack - Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, a... Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index contains an anchor whose `href` is exact

CVE-2018-16471 [MEDIUM] CVE-2018-16471: ruby-rack - There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully... There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping m