Skip to content

capybara-3.39.2.gem: 13 vulnerabilities (highest severity is: 8.7) [main] #52

Open
Open
capybara-3.39.2.gem: 13 vulnerabilities (highest severity is: 8.7) [main]#52

Description

@renovate
renovate
bot
opened on Feb 25, 2026
📂 Vulnerable Library - capybara-3.39.2.gem

Capybara is an integration testing tool for rack based web applications. It simulates how a user would interact with a website

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/capybara-3.39.2.gem

Findings

Finding Severity 🎯 CVSS Exploit Maturity EPSS Library Type Fixed in Remediation Available
CVE-2024-34459 🔴 High 8.7 Not Defined < 1% nokogiri-1.16.0.gem Direct N/A ❌
CVE-2025-27610 🔴 High 8.7 Not Defined < 1% rack-3.0.8.gem Direct N/A ❌
CVE-2025-46727 🔴 High 8.7 Not Defined < 1% rack-3.0.8.gem Direct https://github.com/rack/rack.git - v3.0.16,https://github.com/rack/rack.git - v3.1.14,https://github.com/rack/rack.git - v2.2.14 ✅
CVE-2025-61919 🔴 High 8.7 Not Defined < 1% rack-3.0.8.gem Direct rack - 3.1.18,rack - 3.2.3,rack - 2.2.20 ✅
CVE-2026-22860 🔴 High 8.7 Not Defined < 1% rack-3.0.8.gem Direct https://github.com/rack/rack.git - v3.2.5,https://github.com/rack/rack.git - v3.1.20,https://github.com/rack/rack.git - v2.2.22 ✅
CVE-2025-6490 🔴 High 7.3 Proof of concept < 1% nokogiri-1.16.0.gem Direct N/A ❌
CVE-2024-25126 🟠 Medium 6.9 Not Defined < 1% rack-3.0.8.gem Direct rack - 2.2.8.1,3.0.9.1 ✅
CVE-2024-26141 🟠 Medium 6.9 Not Defined < 1% rack-3.0.8.gem Direct N/A ❌
CVE-2024-26146 🟠 Medium 6.9 Not Defined < 1% rack-3.0.8.gem Direct rack - 2.0.9.4,2.1.4.4,2.2.8.1,3.0.9.1 ✅
CVE-2025-27111 🟠 Medium 6.9 Not Defined < 1% rack-3.0.8.gem Direct 3.1.11,3.0.13,2.2.12,v2.2.12,v3.0.13,v3.1.11 ✅
CVE-2025-61780 🟠 Medium 6.9 Not Defined < 1% rack-3.0.8.gem Direct rack - 3.2.3,rack - 2.2.20,rack - 3.1.18 ✅
CVE-2025-25184 🟠 Medium 5.7 Not Defined 1.0% rack-3.0.8.gem Direct rack - 2.2.11,3.0.12,3.1.11 ✅
CVE-2026-25500 🟠 Medium 5.1 Not Defined < 1% rack-3.0.8.gem Direct https://github.com/rack/rack.git - v2.2.22,https://github.com/rack/rack.git - v3.2.5,https://github.com/rack/rack.git - v3.1.20 ✅

Details

🔴CVE-2024-34459

Vulnerable Library - nokogiri-1.16.0.gem

Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a
sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is
fast and standards-compliant by relying on native parsers like libxml2, libgumbo, or xerces.

Library home page: https://rubygems.org/gems/nokogiri-1.16.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/nokogiri-1.16.0.gem

Dependency Hierarchy:

  • ❌ nokogiri-1.16.0.gem (Vulnerable Library)

  • capybara-3.39.2.gem (Root Library)

    • xpath-3.2.0.gem
      • ❌ nokogiri-1.16.0.gem (Vulnerable Library)

  • azure-storage-blob-2.0.3.gem (Root Library)

    • azure-storage-common-2.0.4.gem
      • ❌ nokogiri-1.16.0.gem (Vulnerable Library)

  • w3c_validators-1.3.7.gem (Root Library)

    • ❌ nokogiri-1.16.0.gem (Vulnerable Library)

Vulnerability Details

An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c. This vulnerability does not affect RubyGem's Nokogiri directly, but its dependency libxml2, which is downloaded during Nokogiri's depndency resolution.

Publish Date: May 13, 2024 12:00 AM

URL: CVE-2024-34459

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🔴CVE-2025-27610

Vulnerable Library - rack-3.0.8.gem

Rack provides a minimal, modular and adaptable interface for developing
web applications in Ruby. By wrapping HTTP requests and responses in
the simplest way possible, it unifies and distills the API for web
servers, web frameworks, and software in between (the so-called
middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-3.0.8.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.0.8.gem

Dependency Hierarchy:

  • sprockets-rails-3.4.2.gem (Root Library)

    • sprockets-4.2.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-scheduler-4.10.2.gem (Root Library)

    • resque-2.6.0.gem
      • sinatra-1.0.gem
        • ❌ rack-3.0.8.gem (Vulnerable Library)

  • ❌ rack-3.0.8.gem (Vulnerable Library)

  • capybara-3.39.2.gem (Root Library)

    • rack-test-2.1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-omakase-1.0.0.gem (Root Library)

    • rubocop-rails-2.23.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-2.23.1.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • sidekiq-7.2.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • propshaft-0.8.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-2.6.0.gem (Root Library)

    • sinatra-1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rack-cache-1.15.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

Vulnerability Details

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, "Rack::Static" can serve files under the specified "root:" even if "urls:" are provided, which may expose other files under the specified "root:" unexpectedly. The vulnerability occurs because "Rack::Static" does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory. By exploiting this vulnerability, an attacker can gain access to all files under the specified "root:" directory, provided they are able to determine then path of the file. Versions 2.2.13, 3.0.14, and 3.1.12 contain a patch for the issue. Other mitigations include removing usage of "Rack::Static", or ensuring that "root:" points at a directory path which only contains files which should be accessed publicly. It is likely that a CDN or similar static file server would also mitigate the issue.

Publish Date: Mar 10, 2025 10:19 PM

URL: CVE-2025-27610

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🔴CVE-2025-46727

Vulnerable Library - rack-3.0.8.gem

Rack provides a minimal, modular and adaptable interface for developing
web applications in Ruby. By wrapping HTTP requests and responses in
the simplest way possible, it unifies and distills the API for web
servers, web frameworks, and software in between (the so-called
middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-3.0.8.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.0.8.gem

Dependency Hierarchy:

  • sprockets-rails-3.4.2.gem (Root Library)

    • sprockets-4.2.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-scheduler-4.10.2.gem (Root Library)

    • resque-2.6.0.gem
      • sinatra-1.0.gem
        • ❌ rack-3.0.8.gem (Vulnerable Library)

  • ❌ rack-3.0.8.gem (Vulnerable Library)

  • capybara-3.39.2.gem (Root Library)

    • rack-test-2.1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-omakase-1.0.0.gem (Root Library)

    • rubocop-rails-2.23.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-2.23.1.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • sidekiq-7.2.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • propshaft-0.8.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-2.6.0.gem (Root Library)

    • sinatra-1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rack-cache-1.15.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

Vulnerability Details

Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, "Rack::QueryParser" parses query strings and "application/x-www-form-urlencoded" bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with extremely large numbers of parameters. The vulnerability arises because "Rack::QueryParser" iterates over each "&"-separated key-value pair and adds it to a Hash without enforcing an upper bound on the total number of parameters. This allows an attacker to send a single request containing hundreds of thousands (or more) of parameters, which consumes excessive memory and CPU during parsing. An attacker can trigger denial of service by sending specifically crafted HTTP requests, which can cause memory exhaustion or pin CPU resources, stalling or crashing the Rack server. This results in full service disruption until the affected worker is restarted. Versions 2.2.14, 3.0.16, and 3.1.14 fix the issue. Some other mitigations are available. One may use middleware to enforce a maximum query string size or parameter count, or employ a reverse proxy (such as Nginx) to limit request sizes and reject oversized query strings or bodies. Limiting request body sizes and query string lengths at the web server or CDN level is an effective mitigation.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: May 07, 2025 11:07 PM

URL: CVE-2025-46727

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin: rack/rack@2bb5263

Release Date: May 07, 2025 11:07 PM

Fix Resolution : https://github.com/rack/rack.git - v3.0.16,https://github.com/rack/rack.git - v3.1.14,https://github.com/rack/rack.git - v2.2.14

🔴CVE-2025-61919

Vulnerable Library - rack-3.0.8.gem

Rack provides a minimal, modular and adaptable interface for developing
web applications in Ruby. By wrapping HTTP requests and responses in
the simplest way possible, it unifies and distills the API for web
servers, web frameworks, and software in between (the so-called
middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-3.0.8.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.0.8.gem

Dependency Hierarchy:

  • sprockets-rails-3.4.2.gem (Root Library)

    • sprockets-4.2.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-scheduler-4.10.2.gem (Root Library)

    • resque-2.6.0.gem
      • sinatra-1.0.gem
        • ❌ rack-3.0.8.gem (Vulnerable Library)

  • ❌ rack-3.0.8.gem (Vulnerable Library)

  • capybara-3.39.2.gem (Root Library)

    • rack-test-2.1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-omakase-1.0.0.gem (Root Library)

    • rubocop-rails-2.23.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-2.23.1.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • sidekiq-7.2.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • propshaft-0.8.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-2.6.0.gem (Root Library)

    • sinatra-1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rack-cache-1.15.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

Vulnerability Details

Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, "Rack::Request#POST" reads the entire request body into memory for "Content-Type: application/x-www-form-urlencoded", calling "rack.input.read(nil)" without enforcing a length or cap. Large request bodies can therefore be buffered completely into process memory before parsing, leading to denial of service (DoS) through memory exhaustion. Users should upgrade to Rack version 2.2.20, 3.1.18, or 3.2.3, anu of which enforces form parameter limits using "query_parser.bytesize_limit", preventing unbounded reads of "application/x-www-form-urlencoded" bodies. Additionally, enforce strict maximum body size at the proxy or web server layer (e.g., Nginx "client_max_body_size", Apache "LimitRequestBody").

Publish Date: Oct 10, 2025 07:22 PM

URL: CVE-2025-61919

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin: GHSA-6xw4-3v39-52mm

Release Date: Oct 10, 2025 07:22 PM

Fix Resolution : rack - 3.1.18,rack - 3.2.3,rack - 2.2.20

🔴CVE-2026-22860

Vulnerable Library - rack-3.0.8.gem

Rack provides a minimal, modular and adaptable interface for developing
web applications in Ruby. By wrapping HTTP requests and responses in
the simplest way possible, it unifies and distills the API for web
servers, web frameworks, and software in between (the so-called
middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-3.0.8.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.0.8.gem

Dependency Hierarchy:

  • sprockets-rails-3.4.2.gem (Root Library)

    • sprockets-4.2.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-scheduler-4.10.2.gem (Root Library)

    • resque-2.6.0.gem
      • sinatra-1.0.gem
        • ❌ rack-3.0.8.gem (Vulnerable Library)

  • ❌ rack-3.0.8.gem (Vulnerable Library)

  • capybara-3.39.2.gem (Root Library)

    • rack-test-2.1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-omakase-1.0.0.gem (Root Library)

    • rubocop-rails-2.23.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-2.23.1.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • sidekiq-7.2.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • propshaft-0.8.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-2.6.0.gem (Root Library)

    • sinatra-1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rack-cache-1.15.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

Vulnerability Details

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, "Rack::Directory"’s path check used a string prefix match on the expanded path. A request like "/../root_example/" can escape the configured root if the target path starts with the root string, allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.

Publish Date: Feb 18, 2026 06:45 PM

URL: CVE-2026-22860

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 8.7

Suggested Fix

Type: Upgrade version

Origin: rack/rack@75c5745

Release Date: Feb 17, 2026 10:25 PM

Fix Resolution : https://github.com/rack/rack.git - v3.2.5,https://github.com/rack/rack.git - v3.1.20,https://github.com/rack/rack.git - v2.2.22

🔴CVE-2025-6490

Vulnerable Library - nokogiri-1.16.0.gem

Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a
sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is
fast and standards-compliant by relying on native parsers like libxml2, libgumbo, or xerces.

Library home page: https://rubygems.org/gems/nokogiri-1.16.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/nokogiri-1.16.0.gem

Dependency Hierarchy:

  • ❌ nokogiri-1.16.0.gem (Vulnerable Library)

  • capybara-3.39.2.gem (Root Library)

    • xpath-3.2.0.gem
      • ❌ nokogiri-1.16.0.gem (Vulnerable Library)

  • azure-storage-blob-2.0.3.gem (Root Library)

    • azure-storage-common-2.0.4.gem
      • ❌ nokogiri-1.16.0.gem (Vulnerable Library)

  • w3c_validators-1.3.7.gem (Root Library)

    • ❌ nokogiri-1.16.0.gem (Vulnerable Library)

Vulnerability Details

A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833 and classified as problematic. This issue affects the function hashmap_set_with_hash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier of the patch is ada4708e5a67114402cd3feb70a4e1d1d7cf773a. It is recommended to apply a patch to fix this issue. The project maintainer explains that the affected code was merged into the main branch but the commit never appeared in an official release.

Publish Date: Jun 22, 2025 07:00 PM

URL: CVE-2025-6490

Threat Assessment

Exploit Maturity:Proof of concept

EPSS:< 1%

Score: 7.3

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🟠CVE-2024-25126

Vulnerable Library - rack-3.0.8.gem

Rack provides a minimal, modular and adaptable interface for developing
web applications in Ruby. By wrapping HTTP requests and responses in
the simplest way possible, it unifies and distills the API for web
servers, web frameworks, and software in between (the so-called
middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-3.0.8.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.0.8.gem

Dependency Hierarchy:

  • sprockets-rails-3.4.2.gem (Root Library)

    • sprockets-4.2.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-scheduler-4.10.2.gem (Root Library)

    • resque-2.6.0.gem
      • sinatra-1.0.gem
        • ❌ rack-3.0.8.gem (Vulnerable Library)

  • ❌ rack-3.0.8.gem (Vulnerable Library)

  • capybara-3.39.2.gem (Root Library)

    • rack-test-2.1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-omakase-1.0.0.gem (Root Library)

    • rubocop-rails-2.23.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-2.23.1.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • sidekiq-7.2.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • propshaft-0.8.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-2.6.0.gem (Root Library)

    • sinatra-1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rack-cache-1.15.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

Vulnerability Details

Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.

Publish Date: Feb 28, 2024 11:28 PM

URL: CVE-2024-25126

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 6.9

Suggested Fix

Type: Upgrade version

Origin: GHSA-22f2-v57c-j9cx

Release Date: Feb 28, 2024 11:28 PM

Fix Resolution : rack - 2.2.8.1,3.0.9.1

🟠CVE-2024-26141

Vulnerable Library - rack-3.0.8.gem

Rack provides a minimal, modular and adaptable interface for developing
web applications in Ruby. By wrapping HTTP requests and responses in
the simplest way possible, it unifies and distills the API for web
servers, web frameworks, and software in between (the so-called
middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-3.0.8.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.0.8.gem

Dependency Hierarchy:

  • sprockets-rails-3.4.2.gem (Root Library)

    • sprockets-4.2.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-scheduler-4.10.2.gem (Root Library)

    • resque-2.6.0.gem
      • sinatra-1.0.gem
        • ❌ rack-3.0.8.gem (Vulnerable Library)

  • ❌ rack-3.0.8.gem (Vulnerable Library)

  • capybara-3.39.2.gem (Root Library)

    • rack-test-2.1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-omakase-1.0.0.gem (Root Library)

    • rubocop-rails-2.23.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-2.23.1.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • sidekiq-7.2.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • propshaft-0.8.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-2.6.0.gem (Root Library)

    • sinatra-1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rack-cache-1.15.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

Vulnerability Details

Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the Rack::File middleware or the Rack::Utils.byte_ranges methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.

Publish Date: Feb 28, 2024 11:28 PM

URL: CVE-2024-26141

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 6.9

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🟠CVE-2024-26146

Vulnerable Library - rack-3.0.8.gem

Rack provides a minimal, modular and adaptable interface for developing
web applications in Ruby. By wrapping HTTP requests and responses in
the simplest way possible, it unifies and distills the API for web
servers, web frameworks, and software in between (the so-called
middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-3.0.8.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.0.8.gem

Dependency Hierarchy:

  • sprockets-rails-3.4.2.gem (Root Library)

    • sprockets-4.2.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-scheduler-4.10.2.gem (Root Library)

    • resque-2.6.0.gem
      • sinatra-1.0.gem
        • ❌ rack-3.0.8.gem (Vulnerable Library)

  • ❌ rack-3.0.8.gem (Vulnerable Library)

  • capybara-3.39.2.gem (Root Library)

    • rack-test-2.1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-omakase-1.0.0.gem (Root Library)

    • rubocop-rails-2.23.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-2.23.1.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • sidekiq-7.2.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • propshaft-0.8.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-2.6.0.gem (Root Library)

    • sinatra-1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rack-cache-1.15.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

Vulnerability Details

Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.

Publish Date: Feb 28, 2024 11:28 PM

URL: CVE-2024-26146

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 6.9

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-26146

Release Date: Feb 28, 2024 11:28 PM

Fix Resolution : rack - 2.0.9.4,2.1.4.4,2.2.8.1,3.0.9.1

🟠CVE-2025-27111

Vulnerable Library - rack-3.0.8.gem

Rack provides a minimal, modular and adaptable interface for developing
web applications in Ruby. By wrapping HTTP requests and responses in
the simplest way possible, it unifies and distills the API for web
servers, web frameworks, and software in between (the so-called
middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-3.0.8.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.0.8.gem

Dependency Hierarchy:

  • sprockets-rails-3.4.2.gem (Root Library)

    • sprockets-4.2.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-scheduler-4.10.2.gem (Root Library)

    • resque-2.6.0.gem
      • sinatra-1.0.gem
        • ❌ rack-3.0.8.gem (Vulnerable Library)

  • ❌ rack-3.0.8.gem (Vulnerable Library)

  • capybara-3.39.2.gem (Root Library)

    • rack-test-2.1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-omakase-1.0.0.gem (Root Library)

    • rubocop-rails-2.23.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-2.23.1.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • sidekiq-7.2.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • propshaft-0.8.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-2.6.0.gem (Root Library)

    • sinatra-1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rack-cache-1.15.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

Vulnerability Details

Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection. This vulnerability is fixed in 2.2.12, 3.0.13, and 3.1.11.

Publish Date: Mar 04, 2025 03:26 PM

URL: CVE-2025-27111

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 6.9

Suggested Fix

Type: Upgrade version

Origin: GHSA-8cgq-6mh2-7j6v

Release Date: Mar 04, 2025 03:26 PM

Fix Resolution : 3.1.11,3.0.13,2.2.12,v2.2.12,v3.0.13,v3.1.11

🟠CVE-2025-61780

Vulnerable Library - rack-3.0.8.gem

Rack provides a minimal, modular and adaptable interface for developing
web applications in Ruby. By wrapping HTTP requests and responses in
the simplest way possible, it unifies and distills the API for web
servers, web frameworks, and software in between (the so-called
middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-3.0.8.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.0.8.gem

Dependency Hierarchy:

  • sprockets-rails-3.4.2.gem (Root Library)

    • sprockets-4.2.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-scheduler-4.10.2.gem (Root Library)

    • resque-2.6.0.gem
      • sinatra-1.0.gem
        • ❌ rack-3.0.8.gem (Vulnerable Library)

  • ❌ rack-3.0.8.gem (Vulnerable Library)

  • capybara-3.39.2.gem (Root Library)

    • rack-test-2.1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-omakase-1.0.0.gem (Root Library)

    • rubocop-rails-2.23.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-2.23.1.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • sidekiq-7.2.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • propshaft-0.8.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-2.6.0.gem (Root Library)

    • sinatra-1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rack-cache-1.15.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

Vulnerability Details

Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, a possible information disclosure vulnerability existed in "Rack::Sendfile" when running behind a proxy that supports "x-sendfile" headers (such as Nginx). Specially crafted headers could cause "Rack::Sendfile" to miscommunicate with the proxy and trigger unintended internal requests, potentially bypassing proxy-level access restrictions. When "Rack::Sendfile" received untrusted "x-sendfile-type" or "x-accel-mapping" headers from a client, it would interpret them as proxy configuration directives. This could cause the middleware to send a "redirect" response to the proxy, prompting it to reissue a new internal request that was not subject to the proxy's access controls. An attacker could exploit this by setting a crafted "x-sendfile-type: x-accel-redirect" header, setting a crafted "x-accel-mapping" header, and requesting a path that qualifies for proxy-based acceleration. Attackers could bypass proxy-enforced restrictions and access internal endpoints intended to be protected (such as administrative pages). The vulnerability did not allow arbitrary file reads but could expose sensitive application routes. This issue only affected systems meeting all of the following conditions: The application used "Rack::Sendfile" with a proxy that supports "x-accel-redirect" (e.g., Nginx); the proxy did not always set or remove the "x-sendfile-type" and "x-accel-mapping" headers; and the application exposed an endpoint that returned a body responding to ".to_path". Users should upgrade to Rack versions 2.2.20, 3.1.18, or 3.2.3, which require explicit configuration to enable "x-accel-redirect". Alternatively, configure the proxy to always set or strip the header, or in Rails applications, disable sendfile completely.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: Oct 10, 2025 04:53 PM

URL: CVE-2025-61780

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 6.9

Suggested Fix

Type: Upgrade version

Origin: GHSA-r657-rxjc-j557

Release Date: Oct 10, 2025 04:53 PM

Fix Resolution : rack - 3.2.3,rack - 2.2.20,rack - 3.1.18

🟠CVE-2025-25184

Vulnerable Library - rack-3.0.8.gem

Rack provides a minimal, modular and adaptable interface for developing
web applications in Ruby. By wrapping HTTP requests and responses in
the simplest way possible, it unifies and distills the API for web
servers, web frameworks, and software in between (the so-called
middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-3.0.8.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.0.8.gem

Dependency Hierarchy:

  • sprockets-rails-3.4.2.gem (Root Library)

    • sprockets-4.2.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-scheduler-4.10.2.gem (Root Library)

    • resque-2.6.0.gem
      • sinatra-1.0.gem
        • ❌ rack-3.0.8.gem (Vulnerable Library)

  • ❌ rack-3.0.8.gem (Vulnerable Library)

  • capybara-3.39.2.gem (Root Library)

    • rack-test-2.1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-omakase-1.0.0.gem (Root Library)

    • rubocop-rails-2.23.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-2.23.1.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • sidekiq-7.2.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • propshaft-0.8.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-2.6.0.gem (Root Library)

    • sinatra-1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rack-cache-1.15.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

Vulnerability Details

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. When a user provides the authorization credentials via Rack::Auth::Basic, if success, the username will be put in env['REMOTE_USER'] and later be used by Rack::CommonLogger for logging purposes. The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the logfile. Attackers can break log formats or insert fraudulent entries, potentially obscuring real activity or injecting malicious data into log files. Versions 2.2.11, 3.0.12, and 3.1.10 contain a fix.

Publish Date: Feb 12, 2025 04:20 PM

URL: CVE-2025-25184

Threat Assessment

Exploit Maturity:Not Defined

EPSS:1.0%

Score: 5.7

Suggested Fix

Type: Upgrade version

Origin: GHSA-7g2v-jj9q-g3rg

Release Date: Feb 12, 2025 04:20 PM

Fix Resolution : rack - 2.2.11,3.0.12,3.1.11

🟠CVE-2026-25500

Vulnerable Library - rack-3.0.8.gem

Rack provides a minimal, modular and adaptable interface for developing
web applications in Ruby. By wrapping HTTP requests and responses in
the simplest way possible, it unifies and distills the API for web
servers, web frameworks, and software in between (the so-called
middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-3.0.8.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.0.8.gem

Dependency Hierarchy:

  • sprockets-rails-3.4.2.gem (Root Library)

    • sprockets-4.2.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-scheduler-4.10.2.gem (Root Library)

    • resque-2.6.0.gem
      • sinatra-1.0.gem
        • ❌ rack-3.0.8.gem (Vulnerable Library)

  • ❌ rack-3.0.8.gem (Vulnerable Library)

  • capybara-3.39.2.gem (Root Library)

    • rack-test-2.1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-omakase-1.0.0.gem (Root Library)

    • rubocop-rails-2.23.1.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rubocop-rails-2.23.1.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • sidekiq-7.2.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • propshaft-0.8.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

  • resque-2.6.0.gem (Root Library)

    • sinatra-1.0.gem
      • ❌ rack-3.0.8.gem (Vulnerable Library)

  • rack-cache-1.15.0.gem (Root Library)

    • ❌ rack-3.0.8.gem (Vulnerable Library)

Vulnerability Details

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, "Rack::Directory" generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the "javascript:" scheme (e.g. "javascript:alert(1)"), the generated index contains an anchor whose "href" is exactly "javascript:alert(1)". Clicking the entry executes JavaScript in the browser (demonstrated with "alert(1)"). Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.

Publish Date: Feb 18, 2026 06:59 PM

URL: CVE-2026-25500

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 5.1

Suggested Fix

Type: Upgrade version

Origin: rack/rack@f2f225f

Release Date: Feb 17, 2026 10:25 PM

Fix Resolution : https://github.com/rack/rack.git - v2.2.22,https://github.com/rack/rack.git - v3.2.5,https://github.com/rack/rack.git - v3.1.20

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions