Rack is a widely used middleware and adapter library for Ruby web applications that normalizes the interface between application servers and HTTP frameworks, placing it in the request path of many deployed services. Its vulnerability profile concentrates in path-traversal and resource-consumption weaknesses that reflect its role as a request-parsing and routing layer, combined with recurring information-disclosure issues tied to directory and error handling. Defenders should monitor this vendor's advisories closely given its deep presence in Ruby application stacks; current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Rack Project over time
Signals from CVEs in this vendor scope (51 CVEs).
51 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-25126HIGH Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible deni | Feb 29, 2024 | 7.5 | 40 | NO | NO |
CVE-2026-39324CRITICAL Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when configured with secret | Apr 7, 2026 | 9.8 | 32 | NO | NO |
CVE-2026-34826HIGH Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.get_byte_ranges parses the HTTP Range header without limiting the number of in | Apr 2, 2026 | 7.5 | 29 | NO | NO |
CVE-2026-34785HIGH Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a static file using a simple | Apr 2, 2026 | 7.5 | 29 | NO | NO |
CVE-2026-34230HIGH Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.select_best_encoding processes Accept-Encoding values with quadratic time comp | Apr 2, 2026 | 7.5 | 29 | NO | NO |
CVE-2020-8161HIGH A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack wh | Jul 2, 2020 | 8.6 | 29 | NO | NO |
CVE-2026-34827HIGH Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Multipart::Parser#handle_mime_head parses quoted multipart | Apr 2, 2026 | 7.5 | 28 | NO | NO |
CVE-2026-34829HIGH Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a BoundedIO when CONTENT_LENGTH is | Apr 2, 2026 | 7.5 | 28 | NO | NO |
CVE-2026-22860HIGH Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path check used a string prefix match on the expanded path. A request | Feb 18, 2026 | 7.5 | 28 | NO | NO |
CVE-2025-61772HIGH Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` can accumulate unbounded data when a multipart part’s header | Oct 7, 2025 | 7.5 | 27 | NO | NO |
Signals from CVEs in this vendor scope (51 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Rack Project.
Media articles that mention a CVE ID that affects a product developed by Rack Project — matched by CVE ID, not by vendor name.