Rack Release Notes | HeroDevs Docs

April 2026

Released Apr 14, 2026

8 More

CVE-2026-34835 - Rack::Request accepts invalid Host characters, enabling host allowlist bypass.
CVE-2026-34831 - Content-Length mismatch in Rack::Files error responses.
CVE-2026-34830 - Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect.
CVE-2026-34829 - Multipart parsing without Content-Length header allows unbounded chunked file uploads.
CVE-2026-34827 - Quadratic-time multipart header parsing allows denial of service via escape-heavy quoted parameters.
CVE-2026-34826 - Multipart byte range processing allows denial of service via excessive overlapping ranges.
CVE-2026-34786 - Rack::Static header_rules bypass via URL-encoded path mismatch.
CVE-2026-34785 - Rack::Static prefix matching can expose unintended files under the static root.
CVE-2026-34763 - Root directory disclosure via unescaped regex interpolation in Rack::Directory.
CVE-2026-34230 - Avoid O(n^2) algorithm in Rack::Utils.select_best_encoding which could lead to denial of service.
CVE-2026-32762 - Forwarded header semicolon injection enables Host and Scheme spoofing.
CVE-2026-26962 - Improper unfolding of folded multipart headers preserves CRLF in parsed parameter.
CVE-2026-26961 - Raise error for multipart requests with multiple boundary parameters.

March 2026

Released Mar 4, 2026

This is the initial release of Never-Ending Support (NES) for Rack v2.3.x.
This release contains no functional change from the OSS rack v3.2.5.

CVE-2026-25500 - XSS injection via malicious filename in Rack::Directory.
CVE-2026-22860 - Directory traversal via root prefix bypass in Rack::Directory.

Rack 3.2 Release Notes