Rack Project vulnerabilities
We track 4 vulnerabilities in Rack Project products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on February 29, 2024.
Latest Rack Project vulnerabilities
- 7.5 High severity
rack: Inefficient Regular Expression Complexity
Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this p
- 7.5 High severity
rack: Uncontrolled Resource Consumption
Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `
- 7.5 High severity
rack: Inefficient Regular Expression Complexity
Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is
- 10.0 Critical severity
https://github.com/rack/rack: Improper Neutralization of Escape, Meta, or Control Sequences
A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.