Rack Project Rack 3.0.0 Release Candidate 1 for Ruby

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:rack_project:rack:3.0.0:rc1:*:*:*:ruby:*:*

part: a version: 3.0.0 update: rc1

VendorRack Project (769ee8c2-0eb9-5278-96b8-ddd991e4993c)
ProductRack (24003e51-ac5c-53cf-baa4-c1777fb8ccb5)
Edition*
Language*
Software edition*
Target softwareruby
Target hardware*
Other*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:deb/debian/ruby-rack purl2cpe 2026-06-01 10:13:32.558752
pkg:deb/ubuntu/ruby-rack purl2cpe 2026-06-01 10:13:32.558754
pkg:gem/rack purl2cpe 2026-06-01 10:13:32.558755
pkg:github/rack/rack purl2cpe 2026-06-01 10:13:32.558756
pkg:rpm/fedora/rubygem-rack purl2cpe 2026-06-01 10:13:32.558758
pkg:rpm/opensuse/rubygem-rack purl2cpe 2026-06-01 10:13:32.558759

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-25126 vulnerable 2026-06-08 06:31:22.209844 Rack ReDos in content type parsing (2nd degree polynomial)
MEDIUM (5.3)
Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.
Published: 2024-02-28T23:28:07.073Z
Updated: 2025-02-13T17:40:47.635Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.