Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/174176?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/174176?format=api", "purl": "pkg:gem/rack@2.2.21", "type": "gem", "namespace": "", "name": "rack", "version": "2.2.21", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "2.2.23", "latest_non_vulnerable_version": "3.2.6", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/51546?format=api", "vulnerability_id": "VCID-3nmb-xetr-6qbg", "summary": "Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass.\n## Summary\n\n`Rack::Multipart::Parser` extracts the `boundary` parameter from\n`multipart/form-data` using a greedy regular expression. When a\n`Content-Type` header contains multiple `boundary` parameters,\nRack selects the last one rather than the first.\n\nIn deployments where an upstream proxy, WAF, or intermediary\ninterprets the first `boundary` parameter, this mismatch can\nallow an attacker to smuggle multipart content past upstream\ninspection and have Rack parse a different body structure than\nthe intermediary validated.\n\n## Details\n\nRack identifies the multipart boundary using logic equivalent to:\n\n```ruby\nMULTIPART = %r|\\Amultipart/.*boundary=\\\"?([^\\\";,]+)\\\"?|ni\n```\n\nBecause the expression is greedy, it matches the last `boundary=`\nparameter in a header such as:\n\n```http\nContent-Type: multipart/form-data; boundary=safe; boundary=malicious\n```\n\nAs a result, Rack parses the request body using `malicious`, while\nanother component may interpret the same header using `safe`.\n\nThis creates an interpretation conflict. If an upstream WAF or proxy\ninspects multipart parts using the first boundary and Rack later\nparses the body using the last boundary, a client may be able to\nplace malicious form fields or uploaded content in parts that Rack\naccepts but the upstream component did not inspect as intended.\n\nThis issue is most relevant in layered deployments where security\ndecisions are made before the request reaches Rack.\n\n## Impact\n\nApplications that accept `multipart/form-data` uploads behind an\ninspecting proxy or WAF may be affected.\n\nIn such deployments, an attacker may be able to bypass upstream\nfiltering of uploaded files or form fields by sending a request\nwith multiple `boundary` parameters and relying on the intermediary\nand Rack to parse the request differently.\n\nThe practical impact depends on deployment architecture. If no\nupstream component relies on a different multipart interpretation,\nthis behavior may not provide meaningful additional attacker capability.\n\n## Mitigation\n\n* Update to a patched version of Rack that rejects ambiguous multipart\n `Content-Type` headers or parses duplicate `boundary` parameters\n consistently.\n* Reject requests containing multiple `boundary` parameters.\n* Normalize or regenerate multipart metadata at the trusted edge\n before forwarding requests to Rack.\n* Avoid relying on upstream inspection of malformed multipart\n requests unless duplicate parameter handling is explicitly\n consistent across components.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26961.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-26961.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-26961", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00014", "scoring_system": "epss", "scoring_elements": "0.02834", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-26961" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26961", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26961" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rack/rack", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rack/rack" }, { "reference_url": "https://github.com/rack/rack/security/advisories/GHSA-vgpv-f759-9wx3", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.7", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "3.7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-03T17:57:50Z/" } ], "url": "https://github.com/rack/rack/security/advisories/GHSA-vgpv-f759-9wx3" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-26961.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-26961.yml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26961", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26961" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454483", "reference_id": "2454483", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454483" }, { "reference_url": "https://github.com/advisories/GHSA-vgpv-f759-9wx3", "reference_id": "GHSA-vgpv-f759-9wx3", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-vgpv-f759-9wx3" }, { "reference_url": "https://usn.ubuntu.com/8182-1/", "reference_id": "USN-8182-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8182-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/110088?format=api", "purl": "pkg:gem/rack@2.2.23", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@2.2.23" }, { "url": "http://public2.vulnerablecode.io/api/packages/110090?format=api", "purl": "pkg:gem/rack@3.1.21", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.1.21" }, { "url": "http://public2.vulnerablecode.io/api/packages/110093?format=api", "purl": "pkg:gem/rack@3.2.6", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.2.6" } ], "aliases": [ "CVE-2026-26961", "GHSA-vgpv-f759-9wx3" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-3nmb-xetr-6qbg" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/51527?format=api", "vulnerability_id": "VCID-6ydb-e746-vbd8", "summary": "Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header\n## Summary\n\n`Rack::Utils.select_best_encoding` processes `Accept-Encoding` values\nwith quadratic time complexity when the header contains many\nwildcard (`*`) entries. Because this method is used by `Rack::Deflater`\nto choose a response encoding, an unauthenticated attacker can send\na single request with a crafted `Accept-Encoding` header and cause\ndisproportionate CPU consumption on the compression middleware path.\n\nThis results in a denial of service condition for applications\nusing `Rack::Deflater`.\n\n## Details\n\n`Rack::Utils.select_best_encoding` expands parsed `Accept-Encoding`\nvalues into a list of candidate encodings. When an entry is `*`,\nthe method computes the set of concrete encodings by subtracting\nthe encodings already present in the request:\n\n```ruby\nif m == \"*\"\n (available_encodings - accept_encoding.map(&:first)).each do |m2|\n expanded_accept_encoding << [m2, q, preference]\n end\nelse\n expanded_accept_encoding << [m, q, preference]\nend\n```\n\nBecause `accept_encoding.map(&:first)` is evaluated inside the loop,\nit is recomputed for each wildcard entry. If the request contains\n`N` wildcard entries, this produces repeated scans over the full\nparsed header and causes quadratic behavior.\n\nAfter expansion, the method also performs additional work over\n`expanded_accept_encoding`, including per-entry deletion, which\nfurther increases the cost for large inputs.\n\n`Rack::Deflater` invokes this method for each request when the\nmiddleware is enabled:\n\n```ruby\nUtils.select_best_encoding(ENCODINGS, Utils.parse_encodings(accept_encoding))\n```\n\nAs a result, a client can trigger this expensive code path simply\nby sending a large `Accept-Encoding` header containing many\nrepeated wildcard values.\n\nFor example, a request with an approximately 8 KB `Accept-Encoding`\nheader containing about 1,000 `*;q=0.5` entries can cause roughly\n170 ms of CPU time in a single request on the `Rack::Deflater`\npath, compared to a negligible baseline for a normal header.\n\nThis issue is distinct from CVE-2024-26146. That issue concerned\nregular expression denial of service during `Accept` header parsing,\nwhereas this issue arises later during encoding selection after\nthe header has already been parsed.\n\n## Impact\n\nAny Rack application using `Rack::Deflater` may be affected.\n\nAn unauthenticated attacker can send requests with crafted\n`Accept-Encoding` headers to trigger excessive CPU usage in the\nencoding selection logic. Repeated requests can consume worker\ntime disproportionately and reduce application availability.\n\nThe attack does not require invalid HTTP syntax or large payload\nbodies. A single header-sized request is sufficient to reach the\nvulnerable code path.\n\n## Mitigation\n\n* Update to a patched version of Rack in which encoding selection\n does not repeatedly rescan the parsed header for wildcard entries.\n* Avoid enabling `Rack::Deflater` on untrusted traffic.\n* Apply request filtering or header size / format restrictions\n at the reverse proxy or application boundary to limit abusive\n `Accept-Encoding` values.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34230.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34230.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-34230", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00022", "scoring_system": "epss", "scoring_elements": "0.0648", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-34230" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34230", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34230" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rack/rack", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rack/rack" }, { "reference_url": "https://github.com/rack/rack/security/advisories/GHSA-v569-hp3g-36wr", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-02T18:56:03Z/" } ], "url": "https://github.com/rack/rack/security/advisories/GHSA-v569-hp3g-36wr" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34230.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34230.yml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34230", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34230" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454493", "reference_id": "2454493", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454493" }, { "reference_url": "https://github.com/advisories/GHSA-v569-hp3g-36wr", "reference_id": "GHSA-v569-hp3g-36wr", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-v569-hp3g-36wr" }, { "reference_url": "https://usn.ubuntu.com/8182-1/", "reference_id": "USN-8182-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8182-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/110088?format=api", "purl": "pkg:gem/rack@2.2.23", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@2.2.23" }, { "url": "http://public2.vulnerablecode.io/api/packages/110090?format=api", "purl": "pkg:gem/rack@3.1.21", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.1.21" }, { "url": "http://public2.vulnerablecode.io/api/packages/110093?format=api", "purl": "pkg:gem/rack@3.2.6", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.2.6" } ], "aliases": [ "CVE-2026-34230", "GHSA-v569-hp3g-36wr" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-6ydb-e746-vbd8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50172?format=api", "vulnerability_id": "VCID-bj83-rx84-v3g9", "summary": "Rack has a Directory Traversal via Rack:Directory\n`Rack::Directory`’s path check used a string prefix match on the expanded path. A request like `/../root_example/` can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22860.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-22860.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-22860", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00123", "scoring_system": "epss", "scoring_elements": "0.31095", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-22860" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22860", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22860" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rack/rack", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rack/rack" }, { "reference_url": "https://github.com/rack/rack/commit/75c5745c286637a8f049a33790c71237762069e7", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-18T19:27:31Z/" } ], "url": "https://github.com/rack/rack/commit/75c5745c286637a8f049a33790c71237762069e7" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1128479", "reference_id": "1128479", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1128479" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440737", "reference_id": "2440737", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440737" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22860", "reference_id": "CVE-2026-22860", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22860" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-22860.yml", "reference_id": "CVE-2026-22860.YML", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-22860.yml" }, { "reference_url": "https://github.com/advisories/GHSA-mxw3-3hh2-x2mh", "reference_id": "GHSA-mxw3-3hh2-x2mh", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-mxw3-3hh2-x2mh" }, { "reference_url": "https://github.com/rack/rack/security/advisories/GHSA-mxw3-3hh2-x2mh", "reference_id": "GHSA-mxw3-3hh2-x2mh", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-18T19:27:31Z/" } ], "url": "https://github.com/rack/rack/security/advisories/GHSA-mxw3-3hh2-x2mh" }, { "reference_url": "https://usn.ubuntu.com/8066-1/", "reference_id": "USN-8066-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8066-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74064?format=api", "purl": "pkg:gem/rack@2.2.22", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3nmb-xetr-6qbg" }, { "vulnerability": "VCID-6ydb-e746-vbd8" }, { "vulnerability": "VCID-bj83-rx84-v3g9" }, { "vulnerability": "VCID-e8ab-9br9-6ybt" }, { "vulnerability": "VCID-ewfc-rx8b-jfc4" }, { "vulnerability": "VCID-h8af-h199-qqfz" }, { "vulnerability": "VCID-p3dy-qbad-q3ab" }, { "vulnerability": "VCID-r1hk-cy5k-9kad" }, { "vulnerability": "VCID-tc69-2tad-43cv" }, { "vulnerability": "VCID-uh69-24kx-xucy" }, { "vulnerability": "VCID-x373-rhh4-7khm" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@2.2.22" }, { "url": "http://public2.vulnerablecode.io/api/packages/74065?format=api", "purl": "pkg:gem/rack@3.1.20", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3nmb-xetr-6qbg" }, { "vulnerability": "VCID-6ydb-e746-vbd8" }, { "vulnerability": "VCID-bj83-rx84-v3g9" }, { "vulnerability": "VCID-e8ab-9br9-6ybt" }, { "vulnerability": "VCID-ewfc-rx8b-jfc4" }, { "vulnerability": "VCID-h8af-h199-qqfz" }, { "vulnerability": "VCID-hpw3-uw3x-mqgq" }, { "vulnerability": "VCID-p3dy-qbad-q3ab" }, { "vulnerability": "VCID-pydr-47y4-y3fu" }, { "vulnerability": "VCID-r1hk-cy5k-9kad" }, { "vulnerability": "VCID-tc69-2tad-43cv" }, { "vulnerability": "VCID-u1u4-7b3v-fue7" }, { "vulnerability": "VCID-uh69-24kx-xucy" }, { "vulnerability": "VCID-x373-rhh4-7khm" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.1.20" }, { "url": "http://public2.vulnerablecode.io/api/packages/74066?format=api", "purl": "pkg:gem/rack@3.2.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3nmb-xetr-6qbg" }, { "vulnerability": "VCID-6ydb-e746-vbd8" }, { "vulnerability": "VCID-bj83-rx84-v3g9" }, { "vulnerability": "VCID-e8ab-9br9-6ybt" }, { "vulnerability": "VCID-ewfc-rx8b-jfc4" }, { "vulnerability": "VCID-gnc7-wp69-h7ag" }, { "vulnerability": "VCID-h8af-h199-qqfz" }, { "vulnerability": "VCID-hpw3-uw3x-mqgq" }, { "vulnerability": "VCID-p3dy-qbad-q3ab" }, { "vulnerability": "VCID-pydr-47y4-y3fu" }, { "vulnerability": "VCID-r1hk-cy5k-9kad" }, { "vulnerability": "VCID-tc69-2tad-43cv" }, { "vulnerability": "VCID-u1u4-7b3v-fue7" }, { "vulnerability": "VCID-uh69-24kx-xucy" }, { "vulnerability": "VCID-x373-rhh4-7khm" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.2.5" } ], "aliases": [ "CVE-2026-22860", "GHSA-mxw3-3hh2-x2mh" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bj83-rx84-v3g9" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/51542?format=api", "vulnerability_id": "VCID-e8ab-9br9-6ybt", "summary": "Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads\n## Summary\n\n`Rack::Multipart::Parser` only wraps the request body in a `BoundedIO`\nwhen `CONTENT_LENGTH` is present. When a `multipart/form-data` request\nis sent without a `Content-Length` header, such as with HTTP chunked\ntransfer encoding, multipart parsing continues until end-of-stream\nwith no total size limit.\n\nFor file parts, the uploaded body is written directly to a temporary\nfile on disk rather than being constrained by the buffered in-memory\nupload limit. An unauthenticated attacker can therefore stream an\narbitrarily large multipart file upload and consume unbounded disk space.\n\nThis results in a denial of service condition for Rack applications\nthat accept multipart form data.\n\n## Details\n\n`Rack::Multipart::Parser.parse` applies `BoundedIO` only when\n`content_length` is not `nil`:\n\n```ruby\nio = BoundedIO.new(io, content_length) if content_length\n```\n\nWhen `CONTENT_LENGTH` is absent, the parser reads the multipart body\nuntil EOF without a global byte limit.\n\nAlthough Rack enforces `BUFFERED_UPLOAD_BYTESIZE_LIMIT` for retained\nnon-file parts, file uploads are handled differently. When a multipart\npart includes a filename, the body is streamed to a `Tempfile`, and\nthe retained-size accounting is not applied to that file content.\nAs a result, file parts are not subject to the same upload size bound.\n\nAn attacker can exploit this by sending a chunked `multipart/form-data`\nrequest containing a file part and continuously streaming data without\ndeclaring a `Content-Length`. Rack will continue writing the uploaded\ndata to disk until the client stops or the server exhausts available storage.\n\n## Impact\n\nAny Rack application that accepts `multipart/form-data` uploads may be\naffected if no upstream component enforces a request body size limit.\n\nAn unauthenticated attacker can send a large chunked file upload to\nconsume disk space on the application host. This may cause request\nfailures, application instability, or broader service disruption if\nthe host runs out of available storage.\n\nThe practical impact depends on deployment architecture. Reverse proxies\nor application servers that enforce upload limits may reduce or eliminate\nexploitability, but Rack itself does not impose a total multipart\nupload limit in this code path when `CONTENT_LENGTH` is absent.\n\n## Mitigation\n\n* Update to a patched version of Rack that enforces a total multipart\n upload size limit even when `CONTENT_LENGTH` is absent.\n* Enforce request body size limits at the reverse proxy or\n application server.\n* Isolate temporary upload storage and monitor disk consumption\n for multipart endpoints.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34829.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34829.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-34829", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00065", "scoring_system": "epss", "scoring_elements": "0.20434", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-34829" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34829", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34829" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rack/rack", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rack/rack" }, { "reference_url": "https://github.com/rack/rack/security/advisories/GHSA-8vqr-qjwx-82mw", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-02T17:41:27Z/" } ], "url": "https://github.com/rack/rack/security/advisories/GHSA-8vqr-qjwx-82mw" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34829.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34829.yml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34829", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34829" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454488", "reference_id": "2454488", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454488" }, { "reference_url": "https://github.com/advisories/GHSA-8vqr-qjwx-82mw", "reference_id": "GHSA-8vqr-qjwx-82mw", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-8vqr-qjwx-82mw" }, { "reference_url": "https://usn.ubuntu.com/8182-1/", "reference_id": "USN-8182-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8182-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/110088?format=api", "purl": "pkg:gem/rack@2.2.23", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@2.2.23" }, { "url": "http://public2.vulnerablecode.io/api/packages/110090?format=api", "purl": "pkg:gem/rack@3.1.21", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.1.21" }, { "url": "http://public2.vulnerablecode.io/api/packages/110093?format=api", "purl": "pkg:gem/rack@3.2.6", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.2.6" } ], "aliases": [ "CVE-2026-34829", "GHSA-8vqr-qjwx-82mw" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-e8ab-9br9-6ybt" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/51526?format=api", "vulnerability_id": "VCID-ewfc-rx8b-jfc4", "summary": "Rack:: Static header_rules bypass via URL-encoded paths\n## Summary\n\n`Rack::Static#applicable_rules` evaluates several `header_rules`\ntypes against the raw URL-encoded `PATH_INFO`, while the underlying\nfile-serving path is decoded before the file is served. As a result,\na request for a URL-encoded variant of a static path can serve\nthe same file without the headers that `header_rules` were intended to apply.\n\nIn deployments that rely on `Rack::Static` to attach security-relevant\nresponse headers to static content, this can allow an attacker to\nbypass those headers by requesting an encoded form of the path.\n\n## Details\n\n`Rack::Static#applicable_rules` matches rule types such as `:fonts`,\n`Array`, and `Regexp` directly against the incoming `PATH_INFO`. For example:\n\n```ruby\nwhen :fonts\n /\\.(?:ttf|otf|eot|woff2|woff|svg)\\z/.match?(path)\nwhen Array\n /\\.(#{rule.join('|')})\\z/.match?(path)\nwhen Regexp\n rule.match?(path)\n```\n\nThese checks operate on the raw request path. If the request contains\nencoded characters such as `%2E` in place of `.`, the rule may fail\nto match even though the file path is later decoded and served\nsuccessfully by the static file server.\n\nFor example, both of the following requests may resolve to the\nsame file on disk:\n\n```text\n/fonts/test.woff\n/fonts/test%2Ewoff\n```\n\nbut only the unencoded form may receive the headers configured\nthrough `header_rules`.\n\nThis creates a canonicalization mismatch between the path used\nfor header policy decisions and the path ultimately used for file serving.\n\n## Impact\n\nApplications that rely on `Rack::Static` `header_rules` to apply\nsecurity-relevant headers to static files may be affected.\n\nIn affected deployments, an attacker can request an encoded\nvariant of a static file path and receive the same file without\nthe intended headers. Depending on how `header_rules` are used,\nthis may bypass protections such as clickjacking defenses, content\nrestrictions, or other response policies applied to static content.\n\nThe practical impact depends on the configured rules and the types\nof files being served. If `header_rules` are only used for\nnon-security purposes such as caching, the issue may have limited\nsecurity significance.\n\n## Mitigation\n\n* Update to a patched version of Rack that applies `header_rules`\n to a decoded path consistently with static file resolution.\n* Do not rely solely on `Rack::Static` `header_rules` for\n security-critical headers where encoded path variants may\n reach the application.\n* Prefer setting security headers at the reverse proxy or web server\n layer so they apply consistently to both encoded and unencoded path forms.\n* Normalize or reject encoded path variants for static content\n at the edge, where feasible.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34786.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34786.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-34786", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00044", "scoring_system": "epss", "scoring_elements": "0.13782", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-34786" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34786", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34786" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rack/rack", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rack/rack" }, { "reference_url": "https://github.com/rack/rack/security/advisories/GHSA-q4qf-9j86-f5mh", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-03T17:37:20Z/" } ], "url": "https://github.com/rack/rack/security/advisories/GHSA-q4qf-9j86-f5mh" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34786.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34786.yml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34786", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34786" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454507", "reference_id": "2454507", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454507" }, { "reference_url": "https://github.com/advisories/GHSA-q4qf-9j86-f5mh", "reference_id": "GHSA-q4qf-9j86-f5mh", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-q4qf-9j86-f5mh" }, { "reference_url": "https://usn.ubuntu.com/8182-1/", "reference_id": "USN-8182-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8182-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/110088?format=api", "purl": "pkg:gem/rack@2.2.23", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@2.2.23" }, { "url": "http://public2.vulnerablecode.io/api/packages/110090?format=api", "purl": "pkg:gem/rack@3.1.21", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.1.21" }, { "url": "http://public2.vulnerablecode.io/api/packages/110093?format=api", "purl": "pkg:gem/rack@3.2.6", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.2.6" } ], "aliases": [ "CVE-2026-34786", "GHSA-q4qf-9j86-f5mh" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ewfc-rx8b-jfc4" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/51536?format=api", "vulnerability_id": "VCID-h8af-h199-qqfz", "summary": "Rack's multipart byte range processing allows denial of service via excessive overlapping ranges\n## Summary\n\n`Rack::Utils.get_byte_ranges` parses the HTTP `Range` header without\nlimiting the number of individual byte ranges. Although the existing\nfix for CVE-2024-26141 rejects ranges whose total byte coverage\nexceeds the file size, it does not restrict the count of ranges.\nAn attacker can supply many small overlapping ranges such as\n`0-0,0-0,0-0,...` to trigger disproportionate CPU, memory, I/O,\nand bandwidth consumption per request.\n\nThis results in a denial of service condition in Rack file-serving\npaths that process multipart byte range responses.\n\n## Details\n\n`Rack::Utils.get_byte_ranges` accepts a comma-separated list of byte\nranges and validates them based on their aggregate size, but does\nnot impose a limit on how many individual ranges may be supplied.\n\nAs a result, a request such as:\n\n```http\nRange: bytes=0-0,0-0,0-0,0-0,...\n```\n\ncan contain thousands of overlapping one-byte ranges while still\nsatisfying the total-size check added for CVE-2024-26141.\n\nWhen such a header is processed by Rack’s file-serving code, each\nrange causes additional work, including multipart response generation,\nper-range iteration, file seek and read operations, and temporary\nstring allocation for response size calculation and output. This\nallows a relatively small request header to trigger disproportionately\nexpensive processing and a much larger multipart response.\n\nThe issue is distinct from CVE-2024-26141. That fix prevents range\nsets whose total byte coverage exceeds the file size, but does not\nprevent a large number of overlapping ranges whose summed size\nremains within that limit.\n\n## Impact\n\nApplications that expose file-serving paths with byte range support\nmay be vulnerable to denial of service.\n\nAn unauthenticated attacker can send crafted `Range` headers containing\nmany small overlapping ranges to consume excessive CPU time, memory,\nfile I/O, and bandwidth. Repeated requests may reduce application\navailability and increase pressure on workers and garbage collection.\n\n## Mitigation\n\n* Update to a patched version of Rack that limits the number\n of accepted byte ranges.\n* Reject or normalize multipart byte range requests containing\n excessive range counts.\n* Consider disabling multipart range support where it is not required.\n* Apply request filtering or header restrictions at the reverse\n proxy or application boundary to limit abusive `Range` headers.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34826.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34826.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-34826", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00021", "scoring_system": "epss", "scoring_elements": "0.05934", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-34826" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34826", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34826" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rack/rack", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rack/rack" }, { "reference_url": "https://github.com/rack/rack/security/advisories/GHSA-x8cg-fq8g-mxfx", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-02T18:42:34Z/" } ], "url": "https://github.com/rack/rack/security/advisories/GHSA-x8cg-fq8g-mxfx" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34826.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34826.yml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34826", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34826" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454508", "reference_id": "2454508", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454508" }, { "reference_url": "https://github.com/advisories/GHSA-x8cg-fq8g-mxfx", "reference_id": "GHSA-x8cg-fq8g-mxfx", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-x8cg-fq8g-mxfx" }, { "reference_url": "https://usn.ubuntu.com/8182-1/", "reference_id": "USN-8182-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8182-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/110088?format=api", "purl": "pkg:gem/rack@2.2.23", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@2.2.23" }, { "url": "http://public2.vulnerablecode.io/api/packages/110090?format=api", "purl": "pkg:gem/rack@3.1.21", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.1.21" }, { "url": "http://public2.vulnerablecode.io/api/packages/110093?format=api", "purl": "pkg:gem/rack@3.2.6", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.2.6" } ], "aliases": [ "CVE-2026-34826", "GHSA-x8cg-fq8g-mxfx" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-h8af-h199-qqfz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/51538?format=api", "vulnerability_id": "VCID-p3dy-qbad-q3ab", "summary": "Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory\n## Summary\n\n`Rack::Directory` interpolates the configured `root` path directly\ninto a regular expression when deriving the displayed directory path.\nIf `root` contains regex metacharacters such as `+`, `*`, or `.`,\nthe prefix stripping can fail and the generated directory listing\nmay expose the full filesystem path in the HTML output.\n\n## Details\n\n`Rack::Directory::DirectoryBody#each` computes the visible path\nusing code equivalent to:\n\n```ruby\nshow_path = Utils.escape_html(path.sub(/\\A#{root}/, ''))\n```\n\nHere, `root` is a developer-configured filesystem path. It is\nnormalized earlier with `File.expand_path(root)` and then inserted\ndirectly into a regular expression without escaping.\n\nBecause the value is treated as regex syntax rather than as a\nliteral string, metacharacters in the configured path can change\nhow the prefix match behaves. When that happens, the expected root\nprefix is not removed from `path`, and the absolute filesystem path\nis rendered into the HTML directory listing.\n\n## Impact\n\nIf `Rack::Directory` is configured to serve a directory whose\nabsolute path contains regex metacharacters, the generated directory\nlisting may disclose the full server filesystem path instead of\nonly the request-relative path.\n\nThis can expose internal deployment details such as directory\nlayout, usernames, mount points, or naming conventions that would\notherwise not be visible to clients.\n\n## Mitigation\n\n* Update to a patched version of Rack in which the root prefix\n is removed using an escaped regular expression.\n* Avoid using `Rack::Directory` with a root path that contains\n regular expression metacharacters.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34763.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34763.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-34763", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00041", "scoring_system": "epss", "scoring_elements": "0.12996", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-34763" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34763", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34763" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rack/rack", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rack/rack" }, { "reference_url": "https://github.com/rack/rack/security/advisories/GHSA-7mqq-6cf9-v2qp", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-02T17:41:04Z/" } ], "url": "https://github.com/rack/rack/security/advisories/GHSA-7mqq-6cf9-v2qp" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34763.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34763.yml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34763", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34763" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454498", "reference_id": "2454498", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454498" }, { "reference_url": "https://github.com/advisories/GHSA-7mqq-6cf9-v2qp", "reference_id": "GHSA-7mqq-6cf9-v2qp", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-7mqq-6cf9-v2qp" }, { "reference_url": "https://usn.ubuntu.com/8182-1/", "reference_id": "USN-8182-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8182-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/110088?format=api", "purl": "pkg:gem/rack@2.2.23", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@2.2.23" }, { "url": "http://public2.vulnerablecode.io/api/packages/110090?format=api", "purl": "pkg:gem/rack@3.1.21", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.1.21" }, { "url": "http://public2.vulnerablecode.io/api/packages/110093?format=api", "purl": "pkg:gem/rack@3.2.6", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.2.6" } ], "aliases": [ "CVE-2026-34763", "GHSA-7mqq-6cf9-v2qp" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-p3dy-qbad-q3ab" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/51530?format=api", "vulnerability_id": "VCID-r1hk-cy5k-9kad", "summary": "Rack has Content-Length mismatch in Rack::Files error responses\n## Summary\n\n`Rack::Files#fail` sets the `Content-Length` response header using\n`String#size` instead of `String#bytesize`. When the response body\ncontains multibyte UTF-8 characters, the declared `Content-Length`\nis smaller than the number of bytes actually sent on the wire.\n\nBecause `Rack::Files` reflects the requested path in 404 responses,\nan attacker can trigger this mismatch by requesting a non-existent\npath containing percent-encoded UTF-8 characters.\n\nThis results in incorrect HTTP response framing and may cause\nresponse desynchronization in deployments that rely on the\nincorrect `Content-Length` value.\n\n## Details\n\n`Rack::Files#fail` constructs error responses using logic equivalent to:\n\n```ruby\ndef fail(status, body, headers = {})\n body += \"\n\"\n [\n status,\n {\n \"content-type\" => \"text/plain\",\n \"content-length\" => body.size.to_s,\n \"x-cascade\" => \"pass\"\n }.merge!(headers),\n [body]\n ]\nend\n```\n\nHere, `body.size` returns the number of characters, not the number\nof bytes. For multibyte UTF-8 strings, this produces an incorrect\n`Content-Length` value.\n\n`Rack::Files` includes the decoded request path in 404 responses.\nA request containing percent-encoded UTF-8 path components therefore\ncauses the response body to contain multibyte characters, while\nthe `Content-Length` header still reflects character count rather\nthan byte count.\n\nAs a result, the server can send more bytes than declared in\nthe response headers.\n\nThis violates HTTP message framing requirements, which define\n`Content-Length` as the number of octets in the message body.\n\n## Impact\n\nApplications using `Rack::Files` may emit incorrectly framed error\nresponses when handling requests for non-existent paths containing\nmultibyte characters.\n\nIn some deployment topologies, particularly with keep-alive connections\nand intermediaries that rely on `Content-Length`, this mismatch\nmay lead to response parsing inconsistencies or response\ndesynchronization. The practical exploitability depends on the\nbehavior of downstream proxies, clients, and connection reuse.\n\nEven where no secondary exploitation is possible, the response is\nmalformed and may trigger protocol errors in strict components.\n\n## Mitigation\n\n* Update to a patched version of Rack that computes `Content-Length`\n using `String#bytesize`.\n* Avoid exposing `Rack::Files` directly to untrusted traffic until\n a fix is available, if operationally feasible.\n* Where possible, place Rack behind a proxy or server that normalizes\n or rejects malformed backend responses.\n* Prefer closing backend connections on error paths if response\n framing anomalies are a concern.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34831.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34831.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-34831", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00041", "scoring_system": "epss", "scoring_elements": "0.12996", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-34831" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34831", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34831" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rack/rack", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rack/rack" }, { "reference_url": "https://github.com/rack/rack/security/advisories/GHSA-q2ww-5357-x388", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-03T17:43:52Z/" } ], "url": "https://github.com/rack/rack/security/advisories/GHSA-q2ww-5357-x388" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34831.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34831.yml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34831", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34831" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454504", "reference_id": "2454504", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454504" }, { "reference_url": "https://github.com/advisories/GHSA-q2ww-5357-x388", "reference_id": "GHSA-q2ww-5357-x388", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-q2ww-5357-x388" }, { "reference_url": "https://usn.ubuntu.com/8182-1/", "reference_id": "USN-8182-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8182-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/110088?format=api", "purl": "pkg:gem/rack@2.2.23", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@2.2.23" }, { "url": "http://public2.vulnerablecode.io/api/packages/110090?format=api", "purl": "pkg:gem/rack@3.1.21", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.1.21" }, { "url": "http://public2.vulnerablecode.io/api/packages/110093?format=api", "purl": "pkg:gem/rack@3.2.6", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.2.6" } ], "aliases": [ "CVE-2026-34831", "GHSA-q2ww-5357-x388" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-r1hk-cy5k-9kad" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/51540?format=api", "vulnerability_id": "VCID-tc69-2tad-43cv", "summary": "Rack::Static prefix matching can expose unintended files under the static root\n## Summary\n\n`Rack::Static` determines whether a request should be served as a\nstatic file using a simple string prefix check. When configured\nwith URL prefixes such as `\"/css\"`, it matches any request path\nthat begins with that string, including unrelated paths such as\n`\"/css-config.env\"` or `\"/css-backup.sql\"`.\n\nAs a result, files under the static root whose names merely share\nthe configured prefix may be served unintentionally, leading to\ninformation disclosure.\n\n## Details\n\n`Rack::Static#route_file` performs static-route matching using\nlogic equivalent to:\n\n```ruby\n@urls.any? { |url| path.index(url) == 0 }\n```\n\nThis checks only whether the request path starts with the configured\nprefix string. It does not require a path segment boundary after the prefix.\n\nFor example, with:\n\n```ruby\nuse Rack::Static, urls: [\"/css\", \"/js\"], root: \"public\"\n```\n\nthe following path is matched as intended:\n\n```text\n/css/style.css\n```\n\nbut these paths are also matched:\n\n```text\n/css-config.env\n/css-backup.sql\n/csssecrets.yml\n```\n\nIf such files exist under the configured static root, Rack forwards\nthe request to the file server and serves them as static content.\n\nThis means a configuration intended to expose only directory trees\nsuch as `/css/...` and `/js/...` may also expose sibling files\nwhose names begin with those same strings.\n\n## Impact\n\nAn attacker can request files under the configured static root whose\nnames share a configured URL prefix and obtain their contents.\n\nIn affected deployments, this may expose configuration files,\nsecrets, backups, environment files, or other unintended static\ncontent located under the same root directory.\n\n## Mitigation\n\n* Update to a patched version of Rack that enforces a path boundary\n when matching configured static URL prefixes.\n* Match only paths that are either exactly equal to the configured\n prefix or begin with `prefix + \"/\"`.\n* Avoid placing sensitive files under the `Rack::Static` root directory.\n* Prefer static URL mappings that cannot overlap with sensitive filenames.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34785.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34785.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-34785", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.14841", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-34785" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34785", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34785" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rack/rack", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rack/rack" }, { "reference_url": "https://github.com/rack/rack/security/advisories/GHSA-h2jq-g4cq-5ppq", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-02T18:58:57Z/" } ], "url": "https://github.com/rack/rack/security/advisories/GHSA-h2jq-g4cq-5ppq" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34785.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34785.yml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34785", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34785" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454486", "reference_id": "2454486", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454486" }, { "reference_url": "https://github.com/advisories/GHSA-h2jq-g4cq-5ppq", "reference_id": "GHSA-h2jq-g4cq-5ppq", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-h2jq-g4cq-5ppq" }, { "reference_url": "https://usn.ubuntu.com/8182-1/", "reference_id": "USN-8182-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8182-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/110088?format=api", "purl": "pkg:gem/rack@2.2.23", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@2.2.23" }, { "url": "http://public2.vulnerablecode.io/api/packages/110090?format=api", "purl": "pkg:gem/rack@3.1.21", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.1.21" }, { "url": "http://public2.vulnerablecode.io/api/packages/110093?format=api", "purl": "pkg:gem/rack@3.2.6", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.2.6" } ], "aliases": [ "CVE-2026-34785", "GHSA-h2jq-g4cq-5ppq" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-tc69-2tad-43cv" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/51534?format=api", "vulnerability_id": "VCID-uh69-24kx-xucy", "summary": "Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect\n## Summary\n\n`Rack::Sendfile#map_accel_path` interpolates the value of the\n`X-Accel-Mapping` request header directly into a regular expression\nwhen rewriting file paths for `X-Accel-Redirect`. Because the header\nvalue is not escaped, an attacker who can supply `X-Accel-Mapping`\nto the backend can inject regex metacharacters and control the\ngenerated `X-Accel-Redirect` response header.\n\nIn deployments using `Rack::Sendfile` with `x-accel-redirect`, this\ncan allow an attacker to cause nginx to serve unintended files\nfrom configured internal locations.\n\n## Details\n\n`Rack::Sendfile#map_accel_path` processes header-supplied mappings\nusing logic equivalent to:\n\n```ruby\nmapping.split(',').map(&:strip).each do |m|\n internal, external = m.split('=', 2).map(&:strip)\n new_path = path.sub(/\\A#{internal}/i, external)\n return new_path unless path == new_path\nend\n```\n\nHere, `internal` comes from the `HTTP_X_ACCEL_MAPPING` request header\nand is inserted directly into a regular expression without escaping.\nThis gives the header value regex semantics rather than treating\nit as a literal prefix.\n\nAs a result, an attacker can supply metacharacters such as `.*`\nor capture groups to alter how the path substitution is performed.\nFor example, a mapping such as:\n\n```http\nX-Accel-Mapping: .*=/protected/secret.txt\n```\n\ncauses the entire source path to match and rewrites the redirect\ntarget to a clean attacker-chosen internal path.\n\nThis differs from the documented behavior of the header-based\nmapping path, which is described as a simple substitution. While\napplication-supplied mappings may intentionally support regular\nexpressions, header-supplied mappings should be treated as\nliteral path prefixes.\n\nThe issue is only exploitable when untrusted `X-Accel-Mapping`\nheaders can reach Rack. One realistic case is a reverse proxy\nconfiguration that intends to set `X-Accel-Mapping` itself, but\nfails to do so on some routes, allowing a client-supplied header\nto pass through unchanged.\n\n## Impact\n\nApplications using `Rack::Sendfile` with `x-accel-redirect` may\nbe affected if the backend accepts attacker-controlled\n`X-Accel-Mapping` headers.\n\nIn affected deployments, an attacker may be able to control the\n`X-Accel-Redirect` response header and cause nginx to serve files\nfrom internal locations that were not intended to be reachable\nthrough the application. This can lead to unauthorized file disclosure.\n\nThe practical impact depends on deployment architecture. If the\nproxy always strips or overwrites `X-Accel-Mapping`, or if the\napplication uses explicit configured mappings instead of the\nrequest header, exploitability may be eliminated.\n\n## Mitigation\n\n* Update to a patched version of Rack that treats header-supplied\n `X-Accel-Mapping` values as literal strings rather than regular expressions.\n* Strip or overwrite inbound `X-Accel-Mapping` headers at the\n reverse proxy so client-supplied values never reach Rack.\n* Prefer explicit application-configured sendfile mappings\n instead of relying on request-header mappings.\n* Review proxy sub-locations and inherited header settings to\n ensure `X-Accel-Mapping` is consistently set on all backend routes.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34830.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34830.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-34830", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.14841", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-34830" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34830", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34830" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rack/rack", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rack/rack" }, { "reference_url": "https://github.com/rack/rack/security/advisories/GHSA-qv7j-4883-hwh7", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-02T18:59:36Z/" } ], "url": "https://github.com/rack/rack/security/advisories/GHSA-qv7j-4883-hwh7" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34830.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34830.yml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34830", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34830" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454510", "reference_id": "2454510", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454510" }, { "reference_url": "https://github.com/advisories/GHSA-qv7j-4883-hwh7", "reference_id": "GHSA-qv7j-4883-hwh7", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-qv7j-4883-hwh7" }, { "reference_url": "https://usn.ubuntu.com/8182-1/", "reference_id": "USN-8182-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8182-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/110088?format=api", "purl": "pkg:gem/rack@2.2.23", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@2.2.23" }, { "url": "http://public2.vulnerablecode.io/api/packages/110090?format=api", "purl": "pkg:gem/rack@3.1.21", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.1.21" }, { "url": "http://public2.vulnerablecode.io/api/packages/110093?format=api", "purl": "pkg:gem/rack@3.2.6", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.2.6" } ], "aliases": [ "CVE-2026-34830", "GHSA-qv7j-4883-hwh7" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-uh69-24kx-xucy" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/50157?format=api", "vulnerability_id": "VCID-x373-rhh4-7khm", "summary": "Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href\n`Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename begins with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index includes an anchor whose `href` attribute is exactly `javascript:alert(1)`. Clicking this entry executes arbitrary JavaScript in the context of the hosting application.\n\nThis results in a client-side XSS condition in directory listings generated by `Rack::Directory`.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25500.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-25500.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25500", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00025", "scoring_system": "epss", "scoring_elements": "0.07448", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-25500" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25500", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25500" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/rack/rack", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rack/rack" }, { "reference_url": "https://github.com/rack/rack/commit/f2f225f297b99fbee3d9f51255d41f601fc40aff", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-18T19:42:04Z/" } ], "url": "https://github.com/rack/rack/commit/f2f225f297b99fbee3d9f51255d41f601fc40aff" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1128480", "reference_id": "1128480", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1128480" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440738", "reference_id": "2440738", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440738" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25500", "reference_id": "CVE-2026-25500", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25500" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-25500.yml", "reference_id": "CVE-2026-25500.YML", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-25500.yml" }, { "reference_url": "https://github.com/advisories/GHSA-whrj-4476-wvmp", "reference_id": "GHSA-whrj-4476-wvmp", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-whrj-4476-wvmp" }, { "reference_url": "https://github.com/rack/rack/security/advisories/GHSA-whrj-4476-wvmp", "reference_id": "GHSA-whrj-4476-wvmp", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-18T19:42:04Z/" } ], "url": "https://github.com/rack/rack/security/advisories/GHSA-whrj-4476-wvmp" }, { "reference_url": "https://usn.ubuntu.com/8066-1/", "reference_id": "USN-8066-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/8066-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/74064?format=api", "purl": "pkg:gem/rack@2.2.22", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3nmb-xetr-6qbg" }, { "vulnerability": "VCID-6ydb-e746-vbd8" }, { "vulnerability": "VCID-bj83-rx84-v3g9" }, { "vulnerability": "VCID-e8ab-9br9-6ybt" }, { "vulnerability": "VCID-ewfc-rx8b-jfc4" }, { "vulnerability": "VCID-h8af-h199-qqfz" }, { "vulnerability": "VCID-p3dy-qbad-q3ab" }, { "vulnerability": "VCID-r1hk-cy5k-9kad" }, { "vulnerability": "VCID-tc69-2tad-43cv" }, { "vulnerability": "VCID-uh69-24kx-xucy" }, { "vulnerability": "VCID-x373-rhh4-7khm" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@2.2.22" }, { "url": "http://public2.vulnerablecode.io/api/packages/74065?format=api", "purl": "pkg:gem/rack@3.1.20", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3nmb-xetr-6qbg" }, { "vulnerability": "VCID-6ydb-e746-vbd8" }, { "vulnerability": "VCID-bj83-rx84-v3g9" }, { "vulnerability": "VCID-e8ab-9br9-6ybt" }, { "vulnerability": "VCID-ewfc-rx8b-jfc4" }, { "vulnerability": "VCID-h8af-h199-qqfz" }, { "vulnerability": "VCID-hpw3-uw3x-mqgq" }, { "vulnerability": "VCID-p3dy-qbad-q3ab" }, { "vulnerability": "VCID-pydr-47y4-y3fu" }, { "vulnerability": "VCID-r1hk-cy5k-9kad" }, { "vulnerability": "VCID-tc69-2tad-43cv" }, { "vulnerability": "VCID-u1u4-7b3v-fue7" }, { "vulnerability": "VCID-uh69-24kx-xucy" }, { "vulnerability": "VCID-x373-rhh4-7khm" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.1.20" }, { "url": "http://public2.vulnerablecode.io/api/packages/74066?format=api", "purl": "pkg:gem/rack@3.2.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3nmb-xetr-6qbg" }, { "vulnerability": "VCID-6ydb-e746-vbd8" }, { "vulnerability": "VCID-bj83-rx84-v3g9" }, { "vulnerability": "VCID-e8ab-9br9-6ybt" }, { "vulnerability": "VCID-ewfc-rx8b-jfc4" }, { "vulnerability": "VCID-gnc7-wp69-h7ag" }, { "vulnerability": "VCID-h8af-h199-qqfz" }, { "vulnerability": "VCID-hpw3-uw3x-mqgq" }, { "vulnerability": "VCID-p3dy-qbad-q3ab" }, { "vulnerability": "VCID-pydr-47y4-y3fu" }, { "vulnerability": "VCID-r1hk-cy5k-9kad" }, { "vulnerability": "VCID-tc69-2tad-43cv" }, { "vulnerability": "VCID-u1u4-7b3v-fue7" }, { "vulnerability": "VCID-uh69-24kx-xucy" }, { "vulnerability": "VCID-x373-rhh4-7khm" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@3.2.5" } ], "aliases": [ "CVE-2026-25500", "GHSA-whrj-4476-wvmp" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-x373-rhh4-7khm" } ], "fixing_vulnerabilities": [], "risk_score": "4.0", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/rack@2.2.21" }