GCVE - cpe:2.3:a:rack_project:rack:*:*:*:*:*:ruby:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:rack_project:rack:*:*:*:*:*:ruby:*:*

part: a version: * update: *

Vendor	Rack Project (`769ee8c2-0eb9-5278-96b8-ddd991e4993c`)
Product	Rack (`24003e51-ac5c-53cf-baa4-c1777fb8ccb5`)
Edition	*
Language	*
Software edition	*
Target software	ruby
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/ruby-rack`	purl2cpe	2026-06-01 10:13:32.664398
`pkg:deb/ubuntu/ruby-rack`	purl2cpe	2026-06-01 10:13:32.664400
`pkg:gem/rack`	purl2cpe	2026-06-01 10:13:32.664401
`pkg:github/rack/rack`	purl2cpe	2026-06-01 10:13:32.664403
`pkg:rpm/fedora/rubygem-rack`	purl2cpe	2026-06-01 10:13:32.664405
`pkg:rpm/opensuse/rubygem-rack`	purl2cpe	2026-06-01 10:13:32.664406

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-26146`	vulnerable	2026-06-08 06:31:24.895786	Possible Denial of Service Vulnerability in Rack Header Parsing MEDIUM (5.3) Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1. Published: 2024-02-28T23:28:01.158Z Updated: 2025-02-13T17:41:07.669Z Open on db.gcve.eu Reference links https://github.com/rack/rack/security/advisories/GHSA-54rr-7fvw-6x8f https://github.com/rack/rack/commit/30b8e39a578b25d4bdcc082c1c52c6f164b59716 https://github.com/rack/rack/commit/6c5d90bdcec0949f7ba06db62fb740dab394b582 https://github.com/rack/rack/commit/a227cd793778c7c3a827d32808058571569cda6f https://github.com/rack/rack/commit/e4c117749ba24a66f8ec5a08eddf68deeb425ccd	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-26141`	vulnerable	2026-06-08 06:31:24.880092	Possible DoS Vulnerability with Range Header in Rack MEDIUM (5.8) Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1. Published: 2024-02-28T23:28:10.503Z Updated: 2025-02-13T17:41:04.867Z Open on db.gcve.eu Reference links https://github.com/rack/rack/security/advisories/GHSA-xj5v-6v4g-jfw6 https://github.com/rack/rack/commit/4849132bef471adb21131980df745f4bb84de2d9 https://github.com/rack/rack/commit/62457686b26d33a15a254c7768c2076e8e02b48b https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2024-26141.yml	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-27530`	vulnerable	2026-06-08 05:57:41.975248	Details available A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected. Published: 2023-03-10T00:00:00.000Z Updated: 2024-10-15T18:33:52.509Z Open on db.gcve.eu Reference links https://discuss.rubyonrails.org/t/cve-2023-27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388 https://lists.debian.org/debian-lts-announce/2023/04/msg00017.html https://www.debian.org/security/2023/dsa-5530 https://security.netapp.com/advisory/ntap-20231208-0015/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-44572`	vulnerable	2026-06-08 05:49:35.658115	Details available A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. Published: 2023-02-09T00:00:00.000Z Updated: 2024-08-03T13:54:03.874Z Open on db.gcve.eu Reference links https://hackerone.com/reports/1639882 https://www.debian.org/security/2023/dsa-5530 https://security.netapp.com/advisory/ntap-20231208-0014/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-44571`	vulnerable	2026-06-08 05:49:35.657815	Details available There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an attacker to craft an input that can cause Content-Disposition header parsing in Rackto take an unexpected amount of time, possibly resulting in a denial ofservice attack vector. This header is used typically used in multipartparsing. Any applications that parse multipart posts using Rack (virtuallyall Rails applications) are impacted. Published: 2023-02-09T00:00:00.000Z Updated: 2024-08-03T13:54:03.839Z Open on db.gcve.eu Reference links https://discuss.rubyonrails.org/t/cve-2022-44571-possible-denial-of-service-vulnerability-in-rack-content-disposition-parsing/82126 https://www.debian.org/security/2023/dsa-5530 https://security.netapp.com/advisory/ntap-20231208-0013/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-44570`	vulnerable	2026-06-08 05:49:35.656544	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-16782`	vulnerable	2026-06-08 05:13:09.390885	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Rack

Notes

PURL mappings

Vulnerability references

Contribute