rack (RubyGems)
Advisories
137
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.2.6 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update rack # Gemfile: gem "rack", ">= 3.2.6"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-g2pf-xv49-m2h5 Rack::Request accepts invalid Host characters, enabling host allowlist bypass |
Medium EPSS 0.20% |
>= 3.0.0.beta1, < 3.1.21 | 3.1.21 |
| GHSA-g2pf-xv49-m2h5 Rack::Request accepts invalid Host characters, enabling host allowlist bypass |
Medium EPSS 0.20% |
>= 3.2.0, < 3.2.6 | 3.2.6 |
| GHSA-v6x5-cg8r-vv6x Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters |
High EPSS 0.49% |
>= 3.2.0, < 3.2.6 | 3.2.6 |
| GHSA-v6x5-cg8r-vv6x Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters |
High EPSS 0.49% |
>= 3.0.0.beta1, < 3.1.21 | 3.1.21 |
| GHSA-qfgr-crr9-7r49 Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing |
Medium EPSS 0.19% |
>= 3.0.0.beta1, < 3.1.21 | 3.1.21 |
| GHSA-qfgr-crr9-7r49 Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing |
Medium EPSS 0.19% |
>= 3.2.0, < 3.2.6 | 3.2.6 |
| GHSA-rx22-g9mx-qrhv Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values |
Medium EPSS 0.24% |
>= 3.2.0, < 3.2.6 | 3.2.6 |
| GHSA-q2ww-5357-x388 Rack has Content-Length mismatch in Rack::Files error responses |
Medium EPSS 0.15% |
< 2.2.23 | 2.2.23 |
| GHSA-q2ww-5357-x388 Rack has Content-Length mismatch in Rack::Files error responses |
Medium EPSS 0.15% |
>= 3.0.0.beta1, < 3.1.21 | 3.1.21 |
| GHSA-q2ww-5357-x388 Rack has Content-Length mismatch in Rack::Files error responses |
Medium EPSS 0.15% |
>= 3.2.0, < 3.2.6 | 3.2.6 |
| GHSA-qv7j-4883-hwh7 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect |
High EPSS 0.24% |
>= 3.0.0.beta1, < 3.1.21 | 3.1.21 |
| GHSA-qv7j-4883-hwh7 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect |
High EPSS 0.24% |
>= 3.2.0, < 3.2.6 | 3.2.6 |
| GHSA-qv7j-4883-hwh7 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect |
High EPSS 0.24% |
< 2.2.23 | 2.2.23 |
| GHSA-8vqr-qjwx-82mw Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads |
High EPSS 0.38% |
< 2.2.23 | 2.2.23 |
| GHSA-8vqr-qjwx-82mw Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads |
High EPSS 0.38% |
>= 3.2.0, < 3.2.6 | 3.2.6 |
| GHSA-8vqr-qjwx-82mw Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads |
High EPSS 0.38% |
>= 3.0.0.beta1, < 3.1.21 | 3.1.21 |
| GHSA-x8cg-fq8g-mxfx Rack's multipart byte range processing allows denial of service via excessive overlapping ranges |
High EPSS 0.40% |
>= 3.0.0.beta1, < 3.1.21 | 3.1.21 |
| GHSA-x8cg-fq8g-mxfx Rack's multipart byte range processing allows denial of service via excessive overlapping ranges |
High EPSS 0.40% |
< 2.2.23 | 2.2.23 |
| GHSA-x8cg-fq8g-mxfx Rack's multipart byte range processing allows denial of service via excessive overlapping ranges |
High EPSS 0.40% |
>= 3.2.0, < 3.2.6 | 3.2.6 |
| GHSA-q4qf-9j86-f5mh Rack:: Static header_rules bypass via URL-encoded paths |
Medium EPSS 0.20% |
>= 3.0.0.beta1, < 3.1.21 | 3.1.21 |
| GHSA-q4qf-9j86-f5mh Rack:: Static header_rules bypass via URL-encoded paths |
Medium EPSS 0.20% |
>= 3.2.0, < 3.2.6 | 3.2.6 |
| GHSA-q4qf-9j86-f5mh Rack:: Static header_rules bypass via URL-encoded paths |
Medium EPSS 0.20% |
< 2.2.23 | 2.2.23 |
| GHSA-h2jq-g4cq-5ppq Rack::Static prefix matching can expose unintended files under the static root |
High EPSS 0.39% |
>= 3.2.0, < 3.2.6 | 3.2.6 |
| GHSA-h2jq-g4cq-5ppq Rack::Static prefix matching can expose unintended files under the static root |
High EPSS 0.39% |
>= 3.0.0.beta1, < 3.1.21 | 3.1.21 |
| GHSA-h2jq-g4cq-5ppq Rack::Static prefix matching can expose unintended files under the static root |
High EPSS 0.39% |
< 2.2.23 | 2.2.23 |
| GHSA-7mqq-6cf9-v2qp Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory |
Medium EPSS 0.25% |
>= 3.0.0.beta1, < 3.1.21 | 3.1.21 |
| GHSA-7mqq-6cf9-v2qp Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory |
Medium EPSS 0.25% |
>= 3.2.0, < 3.2.6 | 3.2.6 |
| GHSA-7mqq-6cf9-v2qp Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory |
Medium EPSS 0.25% |
< 2.2.23 | 2.2.23 |
| GHSA-v569-hp3g-36wr Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header |
High EPSS 0.45% |
>= 3.2.0, < 3.2.6 | 3.2.6 |
| GHSA-v569-hp3g-36wr Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header |
High EPSS 0.45% |
< 2.2.23 | 2.2.23 |
| GHSA-v569-hp3g-36wr Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header |
High EPSS 0.45% |
>= 3.0.0.beta1, < 3.1.21 | 3.1.21 |
| GHSA-vgpv-f759-9wx3 Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass. |
Medium EPSS 0.26% |
>= 3.2.0, < 3.2.6 | 3.2.6 |
| GHSA-vgpv-f759-9wx3 Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass. |
Medium EPSS 0.26% |
< 2.2.23 | 2.2.23 |
| GHSA-vgpv-f759-9wx3 Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass. |
Medium EPSS 0.26% |
>= 3.0.0.beta1, < 3.1.21 | 3.1.21 |
| GHSA-whrj-4476-wvmp Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href |
Medium EPSS 0.27% |
>= 3.2.0, < 3.2.5 | 3.2.5 |
| GHSA-whrj-4476-wvmp Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href |
Medium EPSS 0.27% |
>= 3.0.0.beta1, < 3.1.20 | 3.1.20 |
| GHSA-whrj-4476-wvmp Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href |
Medium EPSS 0.27% |
< 2.2.22 | 2.2.22 |
| GHSA-mxw3-3hh2-x2mh Rack has a Directory Traversal via Rack:Directory |
High EPSS 0.76% |
< 2.2.22 | 2.2.22 |
| GHSA-mxw3-3hh2-x2mh Rack has a Directory Traversal via Rack:Directory |
High EPSS 0.76% |
>= 3.2.0, < 3.2.5 | 3.2.5 |
| GHSA-mxw3-3hh2-x2mh Rack has a Directory Traversal via Rack:Directory |
High EPSS 0.76% |
>= 3.0.0.beta1, < 3.1.20 | 3.1.20 |
| GHSA-6xw4-3v39-52mm Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing |
High EPSS 0.65% |
< 2.2.20 | 2.2.20 |
| GHSA-6xw4-3v39-52mm Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing |
High EPSS 0.65% |
>= 3.2, < 3.2.3 | 3.2.3 |
| GHSA-6xw4-3v39-52mm Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing |
High EPSS 0.65% |
>= 3.0, < 3.1.18 | 3.1.18 |
| GHSA-r657-rxjc-j557 Rack has a Possible Information Disclosure Vulnerability |
Medium EPSS 0.55% |
< 2.2.20 | 2.2.20 |
| GHSA-r657-rxjc-j557 Rack has a Possible Information Disclosure Vulnerability |
Medium EPSS 0.55% |
>= 3.2, < 3.2.3 | 3.2.3 |
| GHSA-r657-rxjc-j557 Rack has a Possible Information Disclosure Vulnerability |
Medium EPSS 0.55% |
>= 3.0, < 3.1.18 | 3.1.18 |
| GHSA-wpv5-97wm-hp9c Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) |
High EPSS 0.93% |
>= 3.2, < 3.2.2 | 3.2.2 |
| GHSA-wpv5-97wm-hp9c Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) |
High EPSS 0.93% |
>= 3.1, < 3.1.17 | 3.1.17 |
| GHSA-wpv5-97wm-hp9c Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) |
High EPSS 0.93% |
< 2.2.19 | 2.2.19 |
| GHSA-w9pc-fmgc-vxvw Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) |
High EPSS 0.56% |
>= 3.1, < 3.1.17 | 3.1.17 |
| GHSA-w9pc-fmgc-vxvw Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) |
High EPSS 0.56% |
>= 3.2, < 3.2.2 | 3.2.2 |
| GHSA-w9pc-fmgc-vxvw Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) |
High EPSS 0.56% |
< 2.2.19 | 2.2.19 |
| GHSA-p543-xpfm-54cp Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) |
High EPSS 0.93% |
< 2.2.19 | 2.2.19 |
| GHSA-p543-xpfm-54cp Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) |
High EPSS 0.93% |
>= 3.2, < 3.2.2 | 3.2.2 |
| GHSA-p543-xpfm-54cp Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) |
High EPSS 0.93% |
>= 3.1, < 3.1.17 | 3.1.17 |
| GHSA-625h-95r8-8xpm Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters |
High EPSS 0.57% |
< 2.2.18 | 2.2.18 |
| GHSA-47m2-26rw-j2jw ReDoS Vulnerability in Rack::Multipart handle_mime_head |
Medium EPSS 0.58% |
>= 3.1.0, < 3.1.16 | 3.1.16 |
| GHSA-gjh7-p2fx-99vx Rack has an Unbounded-Parameter DoS in Rack::QueryParser |
High EPSS 1.21% |
>= 3.0, < 3.0.16 | 3.0.16 |
| GHSA-gjh7-p2fx-99vx Rack has an Unbounded-Parameter DoS in Rack::QueryParser |
High EPSS 1.21% |
< 2.2.14 | 2.2.14 |
| GHSA-gjh7-p2fx-99vx Rack has an Unbounded-Parameter DoS in Rack::QueryParser |
High EPSS 1.21% |
>= 3.1, < 3.1.14 | 3.1.14 |
| GHSA-vpfw-47h7-xj4g Rack session gets restored after deletion |
Medium EPSS 0.33% |
< 2.2.14 | 2.2.14 |
| GHSA-7wqh-767x-r66v Local File Inclusion in Rack::Static |
High EPSS 1.17% |
< 2.2.13 | 2.2.13 |
| GHSA-7wqh-767x-r66v Local File Inclusion in Rack::Static |
High EPSS 1.17% |
>= 3.1, < 3.1.12 | 3.1.12 |
| GHSA-7wqh-767x-r66v Local File Inclusion in Rack::Static |
High EPSS 1.17% |
>= 3.0, < 3.0.14 | 3.0.14 |
| GHSA-8cgq-6mh2-7j6v Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection |
High EPSS 0.75% |
< 2.2.12 | 2.2.12 |
| GHSA-8cgq-6mh2-7j6v Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection |
High EPSS 0.75% |
>= 3.1, < 3.1.11 | 3.1.11 |
| GHSA-8cgq-6mh2-7j6v Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection |
High EPSS 0.75% |
>= 3.0, < 3.0.13 | 3.0.13 |
| GHSA-7g2v-jj9q-g3rg Possible Log Injection in Rack::CommonLogger |
Medium EPSS 1.19% |
>= 3.0, < 3.0.12 | 3.0.12 |
| GHSA-7g2v-jj9q-g3rg Possible Log Injection in Rack::CommonLogger |
Medium EPSS 1.19% |
< 2.2.11 | 2.2.11 |
| GHSA-7g2v-jj9q-g3rg Possible Log Injection in Rack::CommonLogger |
Medium EPSS 1.19% |
>= 3.1, < 3.1.10 | 3.1.10 |
| GHSA-cj83-2ww7-mvq7 Rack ReDoS Vulnerability in HTTP Accept Headers Parsing |
Medium EPSS 0.86% |
>= 3.1.0, < 3.1.5 | 3.1.5 |
| GHSA-22f2-v57c-j9cx Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial) |
High EPSS 35.38% |
>= 3.0.0, < 3.0.9.1 | 3.0.9.1 |
| GHSA-22f2-v57c-j9cx Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial) |
High EPSS 35.38% |
>= 0.4, < 2.2.8.1 | 2.2.8.1 |
| GHSA-xj5v-6v4g-jfw6 Rack has possible DoS Vulnerability with Range Header |
High EPSS 1.61% |
>= 1.3.0, < 2.2.8.1 | 2.2.8.1 |
| GHSA-xj5v-6v4g-jfw6 Rack has possible DoS Vulnerability with Range Header |
High EPSS 1.61% |
>= 3.0.0, < 3.0.9.1 | 3.0.9.1 |
| GHSA-54rr-7fvw-6x8f Rack Header Parsing leads to Possible Denial of Service Vulnerability |
High EPSS 2.00% |
>= 3.0.0, < 3.0.9.1 | 3.0.9.1 |
| GHSA-54rr-7fvw-6x8f Rack Header Parsing leads to Possible Denial of Service Vulnerability |
High EPSS 2.00% |
< 2.0.9.4 | 2.0.9.4 |
| GHSA-54rr-7fvw-6x8f Rack Header Parsing leads to Possible Denial of Service Vulnerability |
High EPSS 2.00% |
>= 2.1.0, < 2.1.4.4 | 2.1.4.4 |
| GHSA-54rr-7fvw-6x8f Rack Header Parsing leads to Possible Denial of Service Vulnerability |
High EPSS 2.00% |
>= 2.2.0, < 2.2.8.1 | 2.2.8.1 |
| GHSA-c6qg-cjj8-47qp Possible Denial of Service Vulnerability in Rack's header parsing |
Medium EPSS 1.06% |
>= 2.0.0, < 2.2.6.4 | 2.2.6.4 |
| GHSA-c6qg-cjj8-47qp Possible Denial of Service Vulnerability in Rack's header parsing |
Medium EPSS 1.06% |
>= 3.0.0, < 3.0.6.1 | 3.0.6.1 |
| GHSA-3h57-hmj3-gj3p Rack has possible DoS Vulnerability in Multipart MIME parsing |
High EPSS 1.83% |
>= 2.2.0, < 2.2.6.3 | 2.2.6.3 |
| GHSA-3h57-hmj3-gj3p Rack has possible DoS Vulnerability in Multipart MIME parsing |
High EPSS 1.83% |
< 2.0.9.3 | 2.0.9.3 |
| GHSA-3h57-hmj3-gj3p Rack has possible DoS Vulnerability in Multipart MIME parsing |
High EPSS 1.83% |
>= 2.1.0, < 2.1.4.3 | 2.1.4.3 |
| GHSA-3h57-hmj3-gj3p Rack has possible DoS Vulnerability in Multipart MIME parsing |
High EPSS 1.83% |
>= 3.0.0, < 3.0.4.2 | 3.0.4.2 |
| GHSA-93pm-5p5f-3ghx Denial of Service Vulnerability in Rack Content-Disposition parsing |
Low EPSS 1.50% |
>= 2.2.0, < 2.2.6.1 | 2.2.6.1 |
| GHSA-93pm-5p5f-3ghx Denial of Service Vulnerability in Rack Content-Disposition parsing |
Low EPSS 1.50% |
>= 2.0.0, < 2.0.9.2 | 2.0.9.2 |
| GHSA-93pm-5p5f-3ghx Denial of Service Vulnerability in Rack Content-Disposition parsing |
Low EPSS 1.50% |
>= 2.1.0, < 2.1.4.2 | 2.1.4.2 |
| GHSA-93pm-5p5f-3ghx Denial of Service Vulnerability in Rack Content-Disposition parsing |
Low EPSS 1.50% |
>= 3.0.0.0, < 3.0.4.1 | 3.0.4.1 |
| GHSA-65f5-mfpf-vfhj Denial of service via header parsing in Rack |
High EPSS 1.63% |
>= 2.2.0.0, < 2.2.6.2 | 2.2.6.2 |
| GHSA-65f5-mfpf-vfhj Denial of service via header parsing in Rack |
High EPSS 1.63% |
>= 2.1.0.0, < 2.1.4.2 | 2.1.4.2 |
| GHSA-65f5-mfpf-vfhj Denial of service via header parsing in Rack |
High EPSS 1.63% |
>= 1.5.0, < 2.0.9.2 | 2.0.9.2 |
| GHSA-65f5-mfpf-vfhj Denial of service via header parsing in Rack |
High EPSS 1.63% |
>= 3.0.0.0, < 3.0.4.1 | 3.0.4.1 |
| GHSA-rqv2-275x-2jq5 Denial of service via multipart parsing in Rack |
Low EPSS 1.62% |
>= 2.2.0.0, < 2.2.6.1 | 2.2.6.1 |
| GHSA-rqv2-275x-2jq5 Denial of service via multipart parsing in Rack |
Low EPSS 1.62% |
>= 2.0.0, < 2.0.9.2 | 2.0.9.2 |
| GHSA-rqv2-275x-2jq5 Denial of service via multipart parsing in Rack |
Low EPSS 1.62% |
>= 2.1.0.0, < 2.1.4.2 | 2.1.4.2 |
| GHSA-rqv2-275x-2jq5 Denial of service via multipart parsing in Rack |
Low EPSS 1.62% |
>= 3.0.0.0, < 3.0.4.1 | 3.0.4.1 |
| GHSA-hxqx-xwvh-44m2 Denial of Service Vulnerability in Rack Multipart Parsing |
High EPSS 2.23% |
>= 2.2, < 2.2.3.1 | 2.2.3.1 |
| GHSA-hxqx-xwvh-44m2 Denial of Service Vulnerability in Rack Multipart Parsing |
High EPSS 2.23% |
>= 1.2, < 2.0.9.1 | 2.0.9.1 |
| GHSA-hxqx-xwvh-44m2 Denial of Service Vulnerability in Rack Multipart Parsing |
High EPSS 2.23% |
>= 2.1, < 2.1.4.1 | 2.1.4.1 |
| GHSA-wq4h-7r42-5hrr Possible shell escape sequence injection vulnerability in Rack |
Critical EPSS 1.96% |
< 2.0.9.1 | 2.0.9.1 |
| GHSA-wq4h-7r42-5hrr Possible shell escape sequence injection vulnerability in Rack |
Critical EPSS 1.96% |
>= 2.1, < 2.1.4.1 | 2.1.4.1 |
| GHSA-wq4h-7r42-5hrr Possible shell escape sequence injection vulnerability in Rack |
Critical EPSS 1.96% |
>= 2.2, < 2.2.3.1 | 2.2.3.1 |
| GHSA-v6j3-7jrw-hq2p Rack Gem Subject to Denial of Service via Hash Collisions |
Medium EPSS 3.87% |
>= 1.3.0, < 1.3.6 | 1.3.6 |
| GHSA-v6j3-7jrw-hq2p Rack Gem Subject to Denial of Service via Hash Collisions |
Medium EPSS 3.87% |
>= 1.2.0, < 1.2.5 | 1.2.5 |
| GHSA-v6j3-7jrw-hq2p Rack Gem Subject to Denial of Service via Hash Collisions |
Medium EPSS 3.87% |
< 1.1.3 | 1.1.3 |
| GHSA-xc85-32mf-xpv8 Rack arbitrary code execution via timing attack |
Medium EPSS 5.38% |
>= 1.4.0, < 1.4.5 | 1.4.5 |
| GHSA-xc85-32mf-xpv8 Rack arbitrary code execution via timing attack |
Medium EPSS 5.38% |
>= 1.2.0, < 1.2.8 | 1.2.8 |
| GHSA-xc85-32mf-xpv8 Rack arbitrary code execution via timing attack |
Medium EPSS 5.38% |
>= 1.1.0, < 1.1.6 | 1.1.6 |
| GHSA-xc85-32mf-xpv8 Rack arbitrary code execution via timing attack |
Medium EPSS 5.38% |
>= 1.3.0, < 1.3.10 | 1.3.10 |
| GHSA-xc85-32mf-xpv8 Rack arbitrary code execution via timing attack |
Medium EPSS 5.38% |
>= 1.5.0, < 1.5.2 | 1.5.2 |
| GHSA-v882-ccj6-jc48 Rack vulnerable to Denial of Service |
Medium EPSS 2.42% |
>= 1.2.0, < 1.2.7 | 1.2.7 |
| GHSA-v882-ccj6-jc48 Rack vulnerable to Denial of Service |
Medium EPSS 2.42% |
>= 1.1.0, < 1.1.5 | 1.1.5 |
| GHSA-v882-ccj6-jc48 Rack vulnerable to Denial of Service |
Medium EPSS 2.42% |
>= 1.4.0, < 1.4.4 | 1.4.4 |
| GHSA-v882-ccj6-jc48 Rack vulnerable to Denial of Service |
Medium EPSS 2.42% |
>= 1.3.0, < 1.3.9 | 1.3.9 |
| GHSA-5f9h-9pjv-v6j7 Directory traversal in Rack::Directory app bundled with Rack |
High EPSS 3.36% |
< 2.1.3 | 2.1.3 |
| GHSA-j6w9-fv6q-3q52 Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names |
High EPSS 2.94% |
>= 2.2.0, < 2.2.3 | 2.2.3 |
| GHSA-j6w9-fv6q-3q52 Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names |
High EPSS 2.94% |
< 2.1.4 | 2.1.4 |
| GHSA-hrqr-hxpp-chr3 Possible Information Leak / Session Hijack Vulnerability in Rack |
Medium EPSS 3.70% |
>= 2.0.0, < 2.0.8 | 2.0.8 |
| GHSA-hrqr-hxpp-chr3 Possible Information Leak / Session Hijack Vulnerability in Rack |
Medium EPSS 3.70% |
< 1.6.12 | 1.6.12 |
| GHSA-5r2p-j47h-mhpg Rack vulnerable to Cross-site Scripting |
Medium EPSS 1.89% |
< 1.6.11 | 1.6.11 |
| GHSA-5r2p-j47h-mhpg Rack vulnerable to Cross-site Scripting |
Medium EPSS 1.89% |
>= 2.0.0, < 2.0.6 | 2.0.6 |
| GHSA-hg78-4f6x-99wq Rack vulnerable to Denial of Service |
High EPSS 2.03% |
>= 2.0.4, < 2.0.6 | 2.0.6 |
| GHSA-9vc2-p34x-jhxh Moderate severity vulnerability that affects rack Withdrawn |
Medium | >= 1.5.0, < 1.5.4 | 1.5.4 |
| GHSA-9vc2-p34x-jhxh Moderate severity vulnerability that affects rack Withdrawn |
Medium | < 1.4.6 | 1.4.6 |
| GHSA-9vc2-p34x-jhxh Moderate severity vulnerability that affects rack Withdrawn |
Medium | >= 1.6.0, < 1.6.2 | 1.6.2 |
| GHSA-3pxh-h8hw-mj8w Rack rubygems receiving excessively long lines triggers out-of-memory error |
Medium EPSS 3.78% |
>= 1.4.0, < 1.4.3 | 1.4.3 |
| GHSA-h77x-m5q8-c29h Rack vulnerable to REDoS |
Medium EPSS 2.72% |
>= 1.4.0, < 1.4.2 | 1.4.2 |
| GHSA-h77x-m5q8-c29h Rack vulnerable to REDoS |
Medium EPSS 2.72% |
>= 1.2.0, < 1.2.6 | 1.2.6 |
| GHSA-3pxh-h8hw-mj8w Rack rubygems receiving excessively long lines triggers out-of-memory error |
Medium EPSS 3.78% |
>= 1.3.0, < 1.3.8 | 1.3.8 |
| GHSA-85r7-w5mv-c849 Rack Vulnerable to Path Traversal |
Medium EPSS 2.94% |
>= 1.5.0, < 1.5.2 | 1.5.2 |
| GHSA-85r7-w5mv-c849 Rack Vulnerable to Path Traversal |
Medium EPSS 2.94% |
>= 1.4.0, < 1.4.5 | 1.4.5 |
| GHSA-h77x-m5q8-c29h Rack vulnerable to REDoS |
Medium EPSS 2.72% |
< 1.1.4 | 1.1.4 |
| GHSA-h77x-m5q8-c29h Rack vulnerable to REDoS |
Medium EPSS 2.72% |
>= 1.3.0, < 1.3.7 | 1.3.7 |
| GHSA-rgr4-9jh5-j4j6 Rack vulnerable to Denial of Service via large parameter depth request |
Medium EPSS 7.99% |
>= 1.4.0, < 1.4.6 | 1.4.6 |
| GHSA-rgr4-9jh5-j4j6 Rack vulnerable to Denial of Service via large parameter depth request |
Medium EPSS 7.99% |
>= 1.5.0, < 1.5.4 | 1.5.4 |
| GHSA-rgr4-9jh5-j4j6 Rack vulnerable to Denial of Service via large parameter depth request |
Medium EPSS 7.99% |
>= 1.6.0, < 1.6.2 | 1.6.2 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor