gem.coop: rack

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

• Homepage: https://github.com/rack/rack
• Documentation: http://www.rubydoc.info/gems/rack/
• Licenses: MIT
• Latest release: 3.2.8 (published 14 days ago)
• Last Synced: 2026-11-11T21:31:54.727Z (1 day ago)
• Versions: 184
• Dependent Packages: 0
• Dependent Repositories: 0
• Downloads: 1,388,010,752 Total
• Docker Downloads: 1,346,686,159
• Rankings:
  • Dependent repos count: 0.0%
  • Dependent packages count: 0.0%
  • Average: 0.001%
  • Downloads: 0.004%
• Maintainers (6)
  • tenderlove
  • rafaelfranca
  • eileencodes
  • ioquatix
  • raggi
  • chneukirchen
• Advisories:
  • Rack: Multipart parsing allows DoS via unbounded scan buffer growth
  • Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass
  • Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835
  • Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch
  • Rack::Request accepts invalid Host characters, enabling host allowlist bypass
  • Rack has Content-Length mismatch in Rack::Files error responses
  • Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect
  • Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads
  • Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory
  • Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header
  • Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing
  • Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values
  • Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass.
  • Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters
  • Rack's multipart byte range processing allows denial of service via excessive overlapping ranges
  • Rack:: Static header_rules bypass via URL-encoded paths
  • Rack::Static prefix matching can expose unintended files under the static root
  • Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href
  • Rack has a Directory Traversal via Rack:Directory
  • Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing
  • Rack has a Possible Information Disclosure Vulnerability
  • Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
  • Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
  • Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)
  • Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters
  • ReDoS Vulnerability in Rack::Multipart handle_mime_head
  • Rack has an Unbounded-Parameter DoS in Rack::QueryParser
  • Rack session gets restored after deletion
  • Local File Inclusion in Rack::Static
  • Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection
  • Possible Log Injection in Rack::CommonLogger
  • Rack ReDoS Vulnerability in HTTP Accept Headers Parsing
  • Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)
  • Rack has possible DoS Vulnerability with Range Header
  • Rack Header Parsing leads to Possible Denial of Service Vulnerability
  • Possible Denial of Service Vulnerability in Rack's header parsing
  • Rack has possible DoS Vulnerability in Multipart MIME parsing
  • Denial of Service Vulnerability in Rack Content-Disposition parsing
  • Denial of service via header parsing in Rack
  • Denial of service via multipart parsing in Rack
  • Denial of Service Vulnerability in Rack Multipart Parsing
  • Possible shell escape sequence injection vulnerability in Rack
  • Rack Gem Subject to Denial of Service via Hash Collisions
  • Rack arbitrary code execution via timing attack
  • Rack vulnerable to Denial of Service
  • Directory traversal in Rack::Directory app bundled with Rack
  • Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names
  • Possible Information Leak / Session Hijack Vulnerability in Rack
  • Rack vulnerable to Cross-site Scripting
  • Rack vulnerable to Denial of Service
  • Moderate severity vulnerability that affects rack
  • Rack rubygems receiving excessively long lines triggers out-of-memory error
  • Rack Vulnerable to Path Traversal
  • Rack vulnerable to REDoS
  • Rack vulnerable to Denial of Service via large parameter depth request

rubygems.org: rack

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

• Homepage: https://github.com/rack/rack
• Documentation: http://www.rubydoc.info/gems/rack/
• Licenses: MIT
• Latest release: 3.2.8 (published 14 days ago)
• Last Synced: 2026-11-12T12:20:42.084Z (about 22 hours ago)
• Versions: 184
• Dependent Packages: 3,634
• Dependent Repositories: 1,043,594
• Downloads: 1,388,527,377 Total
• Docker Downloads: 1,346,686,159
• Rankings:
  • Dependent repos count: 0.004%
  • Downloads: 0.007%
  • Dependent packages count: 0.014%
  • Average: 0.091%
  • Docker downloads count: 0.098%
  • Forks count: 0.146%
  • Stargazers count: 0.275%
• Maintainers (6)
  • tenderlove
  • rafaelfranca
  • eileencodes
  • ioquatix
  • raggi
  • chneukirchen
• Advisories:
  • Rack: Multipart parsing allows DoS via unbounded scan buffer growth
  • Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass
  • Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835
  • Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch
  • Rack::Request accepts invalid Host characters, enabling host allowlist bypass
  • Rack has Content-Length mismatch in Rack::Files error responses
  • Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect
  • Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads
  • Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory
  • Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header
  • Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing
  • Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values
  • Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass.
  • Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters
  • Rack's multipart byte range processing allows denial of service via excessive overlapping ranges
  • Rack:: Static header_rules bypass via URL-encoded paths
  • Rack::Static prefix matching can expose unintended files under the static root
  • Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href
  • Rack has a Directory Traversal via Rack:Directory
  • Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing
  • Rack has a Possible Information Disclosure Vulnerability
  • Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
  • Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
  • Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)
  • Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters
  • ReDoS Vulnerability in Rack::Multipart handle_mime_head
  • Rack has an Unbounded-Parameter DoS in Rack::QueryParser
  • Rack session gets restored after deletion
  • Local File Inclusion in Rack::Static
  • Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection
  • Possible Log Injection in Rack::CommonLogger
  • Rack ReDoS Vulnerability in HTTP Accept Headers Parsing
  • Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)
  • Rack has possible DoS Vulnerability with Range Header
  • Rack Header Parsing leads to Possible Denial of Service Vulnerability
  • Possible Denial of Service Vulnerability in Rack's header parsing
  • Rack has possible DoS Vulnerability in Multipart MIME parsing
  • Denial of Service Vulnerability in Rack Content-Disposition parsing
  • Denial of service via header parsing in Rack
  • Denial of service via multipart parsing in Rack
  • Denial of Service Vulnerability in Rack Multipart Parsing
  • Possible shell escape sequence injection vulnerability in Rack
  • Rack Gem Subject to Denial of Service via Hash Collisions
  • Rack arbitrary code execution via timing attack
  • Rack vulnerable to Denial of Service
  • Directory traversal in Rack::Directory app bundled with Rack
  • Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names
  • Possible Information Leak / Session Hijack Vulnerability in Rack
  • Rack vulnerable to Cross-site Scripting
  • Rack vulnerable to Denial of Service
  • Moderate severity vulnerability that affects rack
  • Rack rubygems receiving excessively long lines triggers out-of-memory error
  • Rack Vulnerable to Path Traversal
  • Rack vulnerable to REDoS
  • Rack vulnerable to Denial of Service via large parameter depth request

gentoo-portage: dev-ruby/rack

A modular Ruby webserver interface

• Homepage: https://github.com/rack/rack
• Documentation: https://packages.gentoo.org/packages/dev-ruby/rack
• Licenses: MIT
• Latest release: 3.2.4 (published 7 months ago)
• Last Synced: 2026-08-16T04:27:50.322Z (3 months ago)
• Versions: 14
• Dependent Packages: 0
• Dependent Repositories: 0
• Rankings:
  • Dependent repos count: 0.0%
  • Dependent packages count: 0.0%
  • Average: 0.119%
  • Forks count: 0.132%
  • Stargazers count: 0.343%

proxy.golang.org: github.com/rack/rack

• Homepage:
• Documentation: https://pkg.go.dev/github.com/rack/rack#section-documentation
• Licenses: other
• Latest release: v3.2.8+incompatible (published 11 days ago)
• Last Synced: 2026-11-11T21:31:48.459Z (1 day ago)
• Versions: 73
• Dependent Packages: 0
• Dependent Repositories: 0
• Rankings:
  • Forks count: 0.578%
  • Stargazers count: 0.977%
  • Average: 5.483%
  • Dependent packages count: 9.576%
  • Dependent repos count: 10.802%

guix: ruby-rack

Unified web application interface for Ruby

• Homepage: https://github.com/rack/rack
• Documentation: https://git.savannah.gnu.org/cgit/guix.git/tree/gnu/packages/ruby-xyz.scm#n8284
• Licenses: other
• Latest release: 3.2.5 (published 7 months ago)
• Last Synced: 2026-08-16T04:29:38.632Z (3 months ago)
• Versions: 4
• Dependent Packages: 0
• Dependent Repositories: 0
• Rankings:
  • Dependent repos count: 0.0%
  • Dependent packages count: 0.0%
  • Average: 100%