Ruby/rack/2.2.6.2
Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.
https://rubygems.org/gems/rack
MIT
16 Security Vulnerabilities
Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)
- https://github.com/rack/rack/security/advisories/GHSA-22f2-v57c-j9cx
- https://github.com/rack/rack/commit/6efb2ceea003c4b195815a614e00438cbd543462
- https://github.com/rack/rack/commit/d9c163a443b8cadf4711d84bd2c58cb9ef89cf49
- https://discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-25126.yml
- https://github.com/advisories/GHSA-22f2-v57c-j9cx
- https://nvd.nist.gov/vuln/detail/CVE-2024-25126
- https://lists.debian.org/debian-lts-announce/2024/04/msg00022.html
- https://security.netapp.com/advisory/ntap-20240510-0005
Summary
module Rack
class MediaType
SPLIT_PATTERN = %r{\s*[;,]\s*}
The above regexp is subject to ReDos. 50K blank characters as a prefix to the header will take over 10s to split.
PoC
A simple HTTP request with lots of blank characters in the content-type header:
request["Content-Type"] = (" " * 50_000) + "a,"
Impact
It's a very easy to craft ReDoS. Like all ReDoS the impact is debatable.
Rack has possible DoS Vulnerability in Multipart MIME parsing
- https://nvd.nist.gov/vuln/detail/CVE-2023-27530
- https://discuss.rubyonrails.org/t/cve-2023-27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2023-27530.yml
- https://github.com/advisories/GHSA-3h57-hmj3-gj3p
- https://lists.debian.org/debian-lts-announce/2023/04/msg00017.html
- https://www.debian.org/security/2023/dsa-5530
- https://security.netapp.com/advisory/ntap-20231208-0015/
- https://security.netapp.com/advisory/ntap-20231208-0015
There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.
Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3
Impact
The Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Workarounds
A proxy can be configured to limit the POST body size which will mitigate this issue.
Rack Header Parsing leads to Possible Denial of Service Vulnerability
- https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f
- https://github.com/rack/rack/commit/30b8e39a578b25d4bdcc082c1c52c6f164b59716
- https://github.com/rack/rack/commit/6c5d90bdcec0949f7ba06db62fb740dab394b582
- https://github.com/rack/rack/commit/a227cd793778c7c3a827d32808058571569cda6f
- https://github.com/rack/rack/commit/e4c117749ba24a66f8ec5a08eddf68deeb425ccd
- https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26146.yml
- https://github.com/advisories/GHSA-54rr-7fvw-6x8f
- https://nvd.nist.gov/vuln/detail/CVE-2024-26146
Possible Denial of Service Vulnerability in Rack Header Parsing
There is a possible denial of service vulnerability in the header parsing routines in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26146.
Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.4, 2.1.4.4, 2.2.8.1, 3.0.9.1
Impact
Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted.
Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected.
Releases
The fixed releases are available at the normal locations.
Workarounds
There are no feasible workarounds for this issue.
Patches
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
- 2-0-header-redos.patch - Patch for 2.0 series
- 2-1-header-redos.patch - Patch for 2.1 series
- 2-2-header-redos.patch - Patch for 2.2 series
- 3-0-header-redos.patch - Patch for 3.0 series
Credits
Thanks to svalkanov for reporting this and providing patches!
Possible Log Injection in Rack::CommonLogger
- https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg
- https://nvd.nist.gov/vuln/detail/CVE-2025-25184
- https://github.com/rack/rack/commit/074ae244430cda05c27ca91cda699709cfb3ad8e
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-25184.yml
- https://github.com/advisories/GHSA-7g2v-jj9q-g3rg
Summary
Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs.
Details
When a user provides the authorization credentials via Rack::Auth::Basic, if success, the username will be put in env['REMOTE_USER'] and later be used by Rack::CommonLogger for logging purposes.
The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the logfile.
Impact
Attackers can break log formats or insert fraudulent entries, potentially obscuring real activity or injecting malicious data into log files.
Mitigation
- Update to the latest version of Rack.
Local File Inclusion in Rack::Static
- https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v
- https://github.com/rack/rack/commit/50caab74fa01ee8f5dbdee7bb2782126d20c6583
- https://github.com/advisories/GHSA-7wqh-767x-r66v
- https://nvd.nist.gov/vuln/detail/CVE-2025-27610
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-27610.yml
Summary
Rack::Static can serve files under the specified root: even if urls: are provided, which may expose other files under the specified root: unexpectedly.
Details
The vulnerability occurs because Rack::Static does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory.
Impact
By exploiting this vulnerability, an attacker can gain access to all files under the specified root: directory, provided they are able to determine then path of the file.
Mitigation
- Update to the latest version of Rack, or
- Remove usage of
Rack::Static, or - Ensure that
root:points at a directory path which only contains files which should be accessed publicly.
It is likely that a CDN or similar static file server would also mitigate the issue.
Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection
- https://github.com/rack/rack/security/advisories/GHSA-8cgq-6mh2-7j6v
- https://github.com/rack/rack/commit/803aa221e8302719715e224f4476e438f2531a53
- https://github.com/rack/rack/commit/aeac570bb8080ca7b53b7f2e2f67498be7ebd30b
- https://github.com/rack/rack/commit/b13bc6bfc7506aca3478dc5ac1c2ec6fc53f82a3
- https://nvd.nist.gov/vuln/detail/CVE-2025-27111
- https://github.com/advisories/GHSA-8cgq-6mh2-7j6v
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-27111.yml
Summary
Rack::Sendfile can be exploited by crafting input that includes newline characters to manipulate log entries.
Details
The Rack::Sendfile middleware logs unsanitized header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection.
Impact
This vulnerability can distort log files, obscure attack traces, and complicate security auditing.
Mitigation
- Update to the latest version of Rack, or
- Remove usage of
Rack::Sendfile.
Possible Denial of Service Vulnerability in Rack's header parsing
- https://nvd.nist.gov/vuln/detail/CVE-2023-27539
- https://discuss.rubyonrails.org/t/cve-2023-27539-possible-denial-of-service-vulnerability-in-racks-header-parsing/82466
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2023-27539.yml
- https://github.com/advisories/GHSA-c6qg-cjj8-47qp
- https://github.com/rack/rack/commit/231ef369ad0b542575fb36c74fcfcfabcf6c530c
- https://github.com/rack/rack/commit/ee7919ea04303717858be1c3f16b406adc6d8cff
- https://lists.debian.org/debian-lts-announce/2023/04/msg00017.html
- https://security.netapp.com/advisory/ntap-20231208-0016
- https://www.debian.org/security/2023/dsa-5530
There is a denial of service vulnerability in the header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27539.
Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.2.6.4, 3.0.6.1
Impact
Carefully crafted input can cause header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse headers using Rack (virtually all Rails applications) are impacted.
Workarounds
Setting Regexp.timeout in Ruby 3.2 is a possible workaround.
Rack has an Unbounded-Parameter DoS in Rack::QueryParser
- https://github.com/rack/rack/security/advisories/GHSA-gjh7-p2fx-99vx
- https://nvd.nist.gov/vuln/detail/CVE-2025-46727
- https://github.com/rack/rack/commit/2bb5263b464b65ba4b648996a579dbd180d2b712
- https://github.com/rack/rack/commit/3f5a4249118d09d199fe480466c8c6717e43b6e3
- https://github.com/rack/rack/commit/cd6b70a1f2a1016b73dc906f924869f4902c2d74
- https://github.com/advisories/GHSA-gjh7-p2fx-99vx
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-46727.yml
Summary
Rack::QueryParser parses query strings and application/x-www-form-urlencoded bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with extremely large numbers of parameters.
Details
The vulnerability arises because Rack::QueryParser iterates over each &-separated key-value pair and adds it to a Hash without enforcing an upper bound on the total number of parameters. This allows an attacker to send a single request containing hundreds of thousands (or more) of parameters, which consumes excessive memory and CPU during parsing.
Impact
An attacker can trigger denial of service by sending specifically crafted HTTP requests, which can cause memory exhaustion or pin CPU resources, stalling or crashing the Rack server. This results in full service disruption until the affected worker is restarted.
Mitigation
- Update to a version of Rack that limits the number of parameters parsed, or
- Use middleware to enforce a maximum query string size or parameter count, or
- Employ a reverse proxy (such as Nginx) to limit request sizes and reject oversized query strings or bodies.
Limiting request body sizes and query string lengths at the web server or CDN level is an effective mitigation.
Rack session gets restored after deletion
- https://github.com/rack/rack-session/security/advisories/GHSA-9j94-67jr-4cqj
- https://github.com/rack/rack/security/advisories/GHSA-vpfw-47h7-xj4g
- https://nvd.nist.gov/vuln/detail/CVE-2025-32441
- https://github.com/rack/rack/commit/c48e52f7c57e99e1e1bf54c8760d4f082cd1c89d
- https://github.com/rack/rack/blob/v2.2.13/lib/rack/session/abstract/id.rb#L263-L270
- https://github.com/advisories/GHSA-vpfw-47h7-xj4g
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-32441.yml
Summary
When using the Rack::Session::Pool middleware, simultaneous rack requests can restore a deleted rack session, which allows the unauthenticated user to occupy that session.
Details
Rack session middleware prepares the session at the beginning of request, then saves is back to the store with possible changes applied by host rack application. This way the session becomes to be a subject of race conditions in general sense over concurrent rack requests.
Impact
When using the Rack::Session::Pool middleware, and provided the attacker can acquire a session cookie (already a major issue), the session may be restored if the attacker can trigger a long running request (within that same session) adjacent to the user logging out, in order to retain illicit access even after a user has attempted to logout.
Mitigation
- Update to the latest version of
rack, or - Ensure your application invalidates sessions atomically by marking them as logged out e.g., using a
logged_outflag, instead of deleting them, and check this flag on every request to prevent reuse, or - Implement a custom session store that tracks session invalidation timestamps and refuses to accept session data if the session was invalidated after the request began.
Related
As this code was moved to rack-session in Rack 3+, see https://github.com/rack/rack-session/security/advisories/GHSA-9j94-67jr-4cqj for the equivalent advisory in rack-session (affecting Rack 3+ only).
Rack has possible DoS Vulnerability with Range Header
- https://github.com/rack/rack/security/advisories/GHSA-xj5v-6v4g-jfw6
- https://github.com/rack/rack/commit/4849132bef471adb21131980df745f4bb84de2d9
- https://github.com/rack/rack/commit/62457686b26d33a15a254c7768c2076e8e02b48b
- https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26141.yml
- https://github.com/advisories/GHSA-xj5v-6v4g-jfw6
- https://nvd.nist.gov/vuln/detail/CVE-2024-26141
Possible DoS Vulnerability with Range Header in Rack
There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141.
Versions Affected: >= 1.3.0. Not affected: < 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1
Impact
Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue.
Vulnerable applications will use the Rack::File middleware or the
Rack::Utils.byte_ranges methods (this includes Rails applications).
Releases
The fixed releases are available at the normal locations.
Workarounds
There are no feasible workarounds for this issue.
Patches
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
- 3-0-range.patch - Patch for 3.0 series
- 2-2-range.patch - Patch for 2.2 series
Credits
Thank you ooooooo_q for the report and patch
Possible DoS Vulnerability in Multipart MIME parsing
There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.
Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3
Impact
The Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Workarounds
A proxy can be configured to limit the POST body size which will mitigate this issue.
Possible Denial of Service Vulnerability in Rack’s header parsing
There is a denial of service vulnerability in the header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27539.
Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.2.6.4, 3.0.6.1
Impact
Carefully crafted input can cause header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse headers using Rack (virtually all Rails applications) are impacted.
Workarounds
Setting Regexp.timeout in Ruby 3.2 is a possible workaround.
Denial of Service Vulnerability in Rack Content-Type Parsing
There is a possible denial of service vulnerability in the content type parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2024-25126.
Versions Affected: >= 0.4 Not affected: < 0.4 Fixed Versions: 3.0.9.1, 2.2.8.1
Impact
Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability.
Impacted code will use Rack’s media type parser to parse content type headers. This code will look like below:
request.media_type
## OR
request.media_type_params
## OR
Rack::MediaType.type(content_type)
Some frameworks (including Rails) call this code internally, so upgrading is recommended!
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The fixed releases are available at the normal locations.
Workarounds
There are no feasible workarounds for this issue.
Possible DoS Vulnerability with Range Header in Rack
There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141.
Versions Affected: >= 1.3.0. Not affected: < 1.3.0 Fixed Versions: 3.0.9.1, 2.2.8.1
Impact
Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue.
Vulnerable applications will use the Rack::File middleware or the
Rack::Utils.byte_ranges methods (this includes Rails applications).
Releases
The fixed releases are available at the normal locations.
Workarounds
There are no feasible workarounds for this issue.
Possible Denial of Service Vulnerability in Rack Header Parsing
There is a possible denial of service vulnerability in the header parsing routines in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26146.
Versions Affected: All. Not affected: None Fixed Versions: 2.0.9.4, 2.1.4.4, 2.2.8.1, 3.0.9.1
Impact
Carefully crafted headers can cause header parsing in Rack to take longer than
expected resulting in a possible denial of service issue. Accept and
Forwarded headers are impacted.
Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected.
Releases
The fixed releases are available at the normal locations.
Workarounds
There are no feasible workarounds for this issue.
Rack session gets restored after deletion
Summary
When using the Rack::Session::Pool middleware, simultaneous rack
requests can restore a deleted rack session, which allows the
unauthenticated user to occupy that session.
Details
Rack session middleware prepares the session at the beginning of request, then saves is back to the store with possible changes applied by host rack application. This way the session becomes to be a subject of race conditions in general sense over concurrent rack requests.
Impact
When using the Rack::Session::Pool middleware, and provided the
attacker can acquire a session cookie (already a major issue), the
session may be restored if the attacker can trigger a long running
request (within that same session) adjacent to the user logging out,
in order to retain illicit access even after a user has attempted to logout.
Mitigation
- Update to the latest version of
rack, or - Ensure your application invalidates sessions atomically by marking
them as logged out e.g., using a
logged_outflag, instead of deleting them, and check this flag on every request to prevent reuse, or - Implement a custom session store that tracks session invalidation timestamps and refuses to accept session data if the session was invalidated after the request began.
Related
As this code was moved to rack-session in Rack 3+, see
https://github.com/rack/rack-session/security/advisories/GHSA-9j94-67jr-4cqj
for the equivalent advisory in rack-session (affecting Rack 3+ only).
160 Other Versions
| Version | License | Security | Released | |
|---|---|---|---|---|
| 3.1.16 | MIT | 2025-06-04 - 22:28 | 26 days | |
| 3.1.15 | MIT | 2025-05-18 - 02:40 | about 1 month | |
| 3.1.14 | MIT | 2025-05-06 - 21:35 | about 2 months | |
| 3.1.13 | MIT | 2 | 2025-04-13 - 12:28 | 3 months |
| 3.1.12 | MIT | 2 | 2025-03-10 - 21:22 | 4 months |
| 3.1.11 | MIT | 4 | 2025-03-04 - 05:36 | 4 months |
| 3.1.10 | MIT | 6 | 2025-02-12 - 03:29 | 5 months |
| 3.1.9 | MIT | 8 | 2025-01-30 - 22:39 | 5 months |
| 3.1.8 | MIT | 8 | 2024-10-14 - 01:53 | 9 months |
| 3.1.7 | MIT | 8 | 2024-07-11 - 01:46 | 12 months |
| 3.1.6 | MIT | 8 | 2024-07-02 - 15:31 | 12 months |
| 3.1.5 | MIT | 8 | 2024-07-02 - 06:42 | 12 months |
| 3.1.4 | MIT | 10 | 2024-06-22 - 10:00 | about 1 year |
| 3.1.3 | MIT | 10 | 2024-06-12 - 07:25 | about 1 year |
| 3.1.2 | MIT | 10 | 2024-06-11 - 20:39 | about 1 year |
| 3.1.1 | MIT | 10 | 2024-06-11 - 20:03 | about 1 year |
| 3.1.0 | MIT | 10 | 2024-06-11 - 05:50 | about 1 year |
| 3.0.18 | MIT | 2025-05-22 - 06:07 | about 1 month | |
| 3.0.17 | MIT | 2025-05-18 - 02:39 | about 1 month | |
| 3.0.16 | MIT | 2025-05-06 - 21:34 | about 2 months | |
| 3.0.15 | MIT | 1 | 2025-04-13 - 12:19 | 3 months |
| 3.0.14 | MIT | 1 | 2025-03-10 - 21:21 | 4 months |
| 3.0.13 | MIT | 2 | 2025-03-04 - 05:38 | 4 months |
| 3.0.12 | MIT | 3 | 2025-02-12 - 03:33 | 5 months |
| 3.0.11 | MIT | 4 | 2024-05-09 - 22:34 | about 1 year |
| 3.0.10 | MIT | 4 | 2024-03-20 - 21:57 | over 1 year |
| 3.0.9.1 | MIT | 4 | 2024-02-21 - 19:23 | over 1 year |
| 3.0.9 | MIT | 10 | 2024-01-31 - 07:52 | over 1 year |
| 3.0.8 | MIT | 10 | 2023-06-14 - 02:01 | about 2 years |
| 3.0.7 | MIT | 10 | 2023-03-16 - 02:22 | over 2 years |
| 3.0.6.1 | MIT | 10 | 2023-03-13 - 18:10 | over 2 years |
| 3.0.6 | MIT | 12 | 2023-03-13 - 06:00 | over 2 years |
| 3.0.5 | MIT | 12 | 2023-03-12 - 06:28 | over 2 years |
| 3.0.4.2 | MIT | 12 | 2023-03-02 - 22:57 | over 2 years |
| 3.0.4.1 | MIT | 14 | 2023-01-17 - 20:48 | over 2 years |
| 3.0.4 | MIT | 20 | 2023-01-16 - 22:41 | over 2 years |
| 3.0.3 | MIT | 20 | 2022-12-26 - 20:20 | over 2 years |
| 3.0.2 | MIT | 20 | 2022-12-05 - 05:13 | over 2 years |
| 3.0.1 | MIT | 20 | 2022-11-18 - 20:59 | over 2 years |
| 3.0.0 | MIT | 20 | 2022-09-06 - 16:28 | almost 3 years |
| 3.0.0.rc1 | MIT | 8 | 2022-09-04 - 23:52 | almost 3 years |
| 3.0.0.beta1 | MIT | 8 | 2022-08-08 - 20:34 | almost 3 years |
| 2.2.17 | MIT | 2025-06-03 - 01:57 | 28 days | |
| 2.2.16 | MIT | 2025-05-22 - 05:33 | about 1 month | |
| 2.2.15 | MIT | 2025-05-18 - 02:38 | about 1 month | |
| 2.2.14 | MIT | 2025-05-06 - 21:33 | about 2 months | |
| 2.2.13 | MIT | 3 | 2025-03-10 - 21:19 | 4 months |
| 2.2.12 | MIT | 4 | 2025-03-04 - 05:45 | 4 months |
| 2.2.11 | MIT | 5 | 2025-02-12 - 03:54 | 5 months |
| 2.2.10 | MIT | 6 | 2024-10-14 - 01:47 | 9 months |