Rrack

Products

Exploited and recent CVEs

• CVE-2026-39324 Critical 9.3 Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization 0.3%
• CVE-2026-26962 Medium 4.8 Rack: Header injection in multipart requests 0.2%
• CVE-2026-34835 Medium 4.8 Rack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass. 0.2%
• CVE-2026-34827 High 7.5 Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser 0.5%
• CVE-2026-32762 Medium 4.8 Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing 0.2%
• CVE-2026-34830 Medium 5.9 Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginx 0.2%
• CVE-2026-34829 High 7.5 Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length 0.4%
• CVE-2026-34826 Medium 5.3 Rack: Unbounded Range Count in get_byte_ranges Enables DoS 0.4%
• CVE-2026-34786 Medium 5.3 Rack: Rack::Static header_rules bypass via URL-encoded paths 0.2%
• CVE-2026-34785 High 7.5 Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching 0.4%
• CVE-2026-34763 Medium 5.3 Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation 0.2%
• CVE-2026-34831 Medium 4.8 Rack: Content-Length mismatch in Rack::Files error responses 0.2%
• CVE-2026-26961 Low 3.7 Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypass 0.3%
• CVE-2026-34230 Medium 5.3 Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header 0.4%
• CVE-2026-25500 Medium 5.4 Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href 0.3%
• CVE-2026-22860 High 7.5 Rack has a Directory Traversal via Rack:Directory 0.8%
• CVE-2025-61919 High 7.5 Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing 0.6%
• CVE-2025-61780 Medium 5.8 Rack has Possible Information Disclosure Vulnerability 0.6%
• CVE-2025-61772 High 7.5 Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) 0.9%
• CVE-2025-61771 High 7.5 Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) 0.6%
• CVE-2025-61770 High 7.5 Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) 0.9%
• CVE-2025-59830 High 7.5 Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters 0.6%
• CVE-2025-49007 Medium 6.6 ReDoS Vulnerability in Rack::Multipart handle_mime_head 0.6%
• CVE-2025-46336 Medium 4.2 Rack session gets restored after deletion 0.4%
• CVE-2025-46727 High 7.5 Unbounded-Parameter DoS in Rack::QueryParser 1.2%
• CVE-2025-32441 Medium 4.2 Rack session gets restored after deletion 0.3%
• CVE-2025-27610 High 7.5 Local File Inclusion in Rack::Static 1.2%
• CVE-2025-27111 Medium 6.9 Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection 0.8%
• CVE-2025-25184 Medium 5.7 Possible Log Injection in Rack::CommonLogger 1.2%
• CVE-2024-39316 Medium 6.5 Rack ReDoS Vulnerability in HTTP Accept Headers Parsing 0.9%