UbuntuUpdates.org

Package "ruby-rack"

Name: ruby-rack

Description:

modular Ruby webserver interface
Latest version: 3.2.4-1ubuntu1.1
Release: resolute (26.04)
Level: security
Repository: main
Homepage: https://rack.github.io/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "ruby-rack"

All arch deb package
APT INSTALL

Other versions of "ruby-rack" in Resolute

Repository Area Version
base main 3.2.4-1ubuntu1

Changelog

Version: 3.2.4-1ubuntu1.1 2026-11-03 19:08:21 UTC

ruby-rack (3.2.4-1ubuntu1.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Improper input validation
    - debian/patches/CVE-2026-26961.patch: Raise error for multipart requests
      with multiple boundary
    - CVE-2026-26961
  * SECURITY UPDATE: Improper input validation
    - debian/patches/CVE-2026-26962.patch: Backport OBS unfolding for multipart
      requests to 3-1-stable
    - CVE-2026-26962
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2026-32762.patch: Parse Forwarded header instead of
      using regexp scan
    - CVE-2026-32762
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2026-34230.patch: Avoid O(n^2) algorithm in
      Rack::Utils.select_best_encoding
    - CVE-2026-34230
  * SECURITY UPDATE: Path traversal
    - debian/patches/CVE-2026-34763.patch: Root directory disclosure via
      unescaped regex interpolation
    - CVE-2026-34763
  * SECURITY UPDATE: Directory traversal
    - debian/patches/CVE-2026-34785.patch: Fix root prefix bug in Rack::Static
    - CVE-2026-34785
  * SECURITY UPDATE: Header rules bypass
    - debian/patches/CVE-2026-34786.patch: Fix `header_rules` bypass via
      URL-encoded paths
    - CVE-2026-34786
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2026-34826.patch: Use a default limit of 100 byte
      ranges
    - CVE-2026-34826
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2026-34827.patch: Limit the number of quoted escapes
      during multipart parsing
    - CVE-2026-34827
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2026-34829.patch: Add Content-Length size check in
      Rack::Multipart::Parser
    - CVE-2026-34829
  * SECURITY UPDATE: Path traversal
    - debian/patches/CVE-2026-34830.patch: Only do a simple substitution on the
      x-accel-mapping paths
    - CVE-2026-34830
  * SECURITY UPDATE: Improper input validation
    - debian/patches/CVE-2026-34831.patch: Use `String#bytesize` for
      `Content-Length` in error
    - CVE-2026-34831
  * SECURITY UPDATE: Improper input validation
    - debian/patches/CVE-2026-34835.patch: Change Rack::Request::AUTHORITY to
      only match RFC allowed
    - CVE-2026-34835

 -- John Breton Sat, 24 Oct 2026 09:30:21 -0400
CVE-2026-26961 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter fro
CVE-2026-26962 Rack is a modular Ruby web server interface. From version 3.2.0 to before version 3.2.6, Rack::Multipart::Parser unfolds folded multipart part header
CVE-2026-32762 Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21 and 3.2.0 to before 3.2.6, Rack::Utils.forwarded_values parse
CVE-2026-34230 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.select_best_encoding processes Accept-Encoding
CVE-2026-34763 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Directory interpolates the configured root path direc
CVE-2026-34785 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served
CVE-2026-34786 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static#applicable_rules evaluates several header_rule
CVE-2026-34826 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.get_byte_ranges parses the HTTP Range header wi
CVE-2026-34827 Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Multipart::Parser#handle_mi
CVE-2026-34829 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a Bo
CVE-2026-34830 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path interpolates the value of the
CVE-2026-34831 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Files#fail sets the Content-Length response header us
CVE-2026-34835 Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host hea


About   -   Send Feedback to @ubuntu_updates