Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
50 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Rack::Sendfile can be exploited by crafting input that includes newline characters to manipulate log entries. Details The Rack::Sendfile middleware logs unsanitized header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection. Impact This vulnerability can distort log files, obscure attack traces, and complicate security auditing. Mitigation - Update to the latest version of Rack, or - Remove usage of Rack::Sendfile.
Recommended action: Upgrade to 3.1.11, 3.0.13 or 2.2.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. Details When a user provides the authorization credentials via Rack::Auth::Basic, if success, the username will be put in env['REMOTEUSER'] and later be used by Rack::CommonLogger for logging purposes. The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the logfile. Impact Attackers can break log formats or insert fraudulent entries, potentially obscuring real activity or injecting malicious data into log files. Mitigation - Update to the latest version of Rack.
Recommended action: Upgrade to 3.1.10, 3.0.12 or 2.2.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Rack::Request::Helpers module when parsing HTTP Accept headers. This vulnerability can be exploited by an attacker sending specially crafted Accept-Encoding or Accept-Language headers, causing the server to spend excessive time processing the request and leading to a Denial of Service (DoS). Details The fix for https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f was not applied to the main branch and thus while the issue was fixed for the Rack v3.0 release series, it was not fixed in the v3.1 release series until v3.1.5.
Recommended action: Upgrade to 3.1.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The above regexp is subject to ReDos. 50K blank characters as a prefix to the header will take over 10s to split. PoC A simple HTTP request with lots of blank characters in the content-type header: Impact It's a very easy to craft ReDoS. Like all ReDoS the impact is debatable.
Recommended action: Upgrade to 3.0.9.1 or 2.2.8.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Possible DoS Vulnerability with Range Header in Rack There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141. Versions Affected: = 1.3.0. Not affected: < 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1 Impact ------ Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the Rack::File middleware or the Rack::Utils.byteranges methods (this includes Rails applications). Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- There are no feasible workarounds for this issue. Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. 3-0-range.patch - Patch for 3.0 series…
Recommended action: Upgrade to 3.0.9.1 or 2.2.8.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
2.0.9.42.2.8.12.1.4.43.0.9.1· Vendor fix available
Issue
Possible Denial of Service Vulnerability in Rack Header Parsing There is a possible denial of service vulnerability in the header parsing routines in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26146. Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.4, 2.1.4.4, 2.2.8.1, 3.0.9.1 Impact ------ Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- There are no feasible workarounds for this issue. Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. 2-0-header-redos.patch - Patch for…
Recommended action: Upgrade to 3.0.9.1, 2.2.8.1, 2.1.4.4 or 2.0.9.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a denial of service vulnerability in the header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27539. Versions Affected: = 2.0.0 Not affected: None. Fixed Versions: 2.2.6.4, 3.0.6.1 Impact Carefully crafted input can cause header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse headers using Rack (virtually all Rails applications) are impacted. Workarounds Setting Regexp.timeout in Ruby 3.2 is a possible workaround.
Recommended action: Upgrade to 3.0.6.1 or 2.2.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
3.0.4.22.2.6.32.1.4.32.0.9.3· Vendor fix available
Issue
There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530. Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3 Impact The Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected. All users running an affected release should either upgrade or use one of the workarounds immediately. Workarounds A proxy can be configured to limit the POST body size which will mitigate this issue.
Recommended action: Upgrade to 3.0.4.2, 2.2.6.3, 2.1.4.3 or 2.0.9.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
3.0.4.12.2.6.12.0.9.22.1.4.2· Vendor fix available
Issue
There is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44571. Versions Affected: = 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.0.1 Impact Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. Releases The fixed releases are available at the normal locations. Workarounds There are no feasible workarounds for this issue. Patches To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. 2-0-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.0 series…
Recommended action: Upgrade to 3.0.4.1, 2.2.6.1, 2.1.4.2 or 2.0.9.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
2.2.6.23.0.4.12.0.9.22.1.4.2· Vendor fix available
Issue
There is a possible denial of service vulnerability in the Range header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44570. Versions Affected: = 1.5.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.2, 3.0.0.1 Impact Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted. Releases The fixed releases are available at the normal locations. Workarounds There are no feasible workarounds for this issue. Patches To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. 2-0-Fix-ReDoS-in-Rack-Utils.getbyteranges.patch - Patch for 2.0 series…
Recommended action: Upgrade to 3.0.4.1, 2.2.6.2, 2.1.4.2 or 2.0.9.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
3.0.4.12.2.6.12.0.9.22.1.4.2· Vendor fix available
Issue
There is a denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44572. Versions Affected: = 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.0.1 Impact Carefully crafted input can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. Releases The fixed releases are available at the normal locations. Workarounds There are no feasible workarounds for this issue. Patches To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. 2-0-Forbid-control-characters-in-attributes.patch - Patch for 2.0 series 2-1-Forbid-control-characters-in-attributes.patch - Patch for 2.1 series…
Recommended action: Upgrade to 3.0.4.1, 2.2.6.1, 2.1.4.2 or 2.0.9.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a possible denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30122. Versions Affected: = 1.2 Not affected: < 1.2 Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1 Impact Carefully crafted multipart POST requests can cause Rack's multipart parser to take much longer than expected, leading to a possible denial of service vulnerability. Impacted code will use Rack's multipart parser to parse multipart posts. This includes directly using the multipart parser like this: But it also includes reading POST data from a Rack request object like this: All users running an affected release should either upgrade or use one of the workarounds immediately. Workarounds There are no feasible workarounds for this issue.
Recommended action: Upgrade to 2.2.3.1, 2.1.4.1 or 2.0.9.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a possible shell escape sequence injection vulnerability in the Lint and CommonLogger components of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30123. Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.1, 2.1.4.1, 2.2.3.1 Impact Carefully crafted requests can cause shell escape sequences to be written to the terminal via Rack's Lint middleware and CommonLogger middleware. These escape sequences can be leveraged to possibly execute commands in the victim's terminal. Impacted applications will have either of these middleware installed, and vulnerable apps may have something like this: Or All users running an affected release should either upgrade or use one of the workarounds immediately. Workarounds Remove these middleware from your application
Recommended action: Upgrade to 2.2.3.1, 2.1.4.1 or 2.0.9.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Recommended action: Upgrade to 1.3.6, 1.2.5 or 1.1.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
Recommended action: Upgrade to 1.5.2, 1.4.5, 1.3.10 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to "symbolized arbitrary strings."
Recommended action: Upgrade to 1.4.4, 1.3.9, 1.2.7 or 1.1.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.
Recommended action: Upgrade to 2.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it possible for an attacker to forge a secure or host-only cookie prefix.
Recommended action: Upgrade to 2.2.3 or 2.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There's a possible information leak / session hijack vulnerability in Rack. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison. Impact The session id stored in a cookie is the same id that is used when querying the backing session storage engine. Most storage mechanisms (for example a database) use some sort of indexing in order to speed up the lookup of that id. By carefully timing requests and session lookup failures, an attacker may be able to perform a timing attack to determine an existing session id and hijack that…
Recommended action: Upgrade to 2.0.8 or 1.6.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the scheme method on Rack::Request. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted, but applications that bypass the escaping mechanisms, or do not use them may be vulnerable.
Recommended action: Upgrade to 2.0.6 or 1.6.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size.
Recommended action: Upgrade to 2.0.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATHINFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
Recommended action: Upgrade to 1.5.2 or 1.4.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.
Recommended action: Upgrade to 1.4.2, 1.3.7, 1.2.6 or 1.1.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.
Recommended action: Upgrade to 1.4.3 or 1.3.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.
Recommended action: Upgrade to 1.6.2, 1.5.4 or 1.4.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.