`rack`

Ecosystem:
rubygems

Package URL:
pkg:gem/rack

Total PRs:
11,529 Dependabot PRs

Latest PR:
19 days ago

Unique Repositories:
4,526 repositories

Unique Repos (30 days):
5 repositories

Security Advisories

Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values

GHSA-rx22-g9mx-qrhv CVE-2026-26962 MODERATE published 7 months ago • updated 2 days ago

## Summary `Rack::Multipart::Parser` unfolds folded multipart part headers incorrectly. When a multipart header contains an obs-fold sequence, Rac...

Rack has possible DoS Vulnerability in Multipart MIME parsing

GHSA-3h57-hmj3-gj3p CVE-2023-27530 HIGH published over 3 years ago • updated 32 minutes ago

There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-...

Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters

GHSA-625h-95r8-8xpm CVE-2025-59830 HIGH published about 1 year ago • updated 11 days ago

## Summary `Rack::QueryParser` in version `< 2.2.18` enforces its `params_limit` only for parameters separated by `&`, while still splitting on bo...

Rack Header Parsing leads to Possible Denial of Service Vulnerability

GHSA-54rr-7fvw-6x8f CVE-2024-26146 LOW published over 2 years ago • updated 11 days ago

# Possible Denial of Service Vulnerability in Rack Header Parsing There is a possible denial of service vulnerability in the header parsing routin...

Possible shell escape sequence injection vulnerability in Rack

GHSA-wq4h-7r42-5hrr CVE-2022-30123 CRITICAL published over 4 years ago • updated 32 minutes ago

There is a possible shell escape sequence injection vulnerability in the Lint and CommonLogger components of Rack. This vulnerability has been ass...

View all 50 advisories

Recent PRs

RSS Feed

Bump the production-dependencies group with 59 updates

Layerrail/layerrail #231

3.2.6 → 3.2.7 Patch PR

Closed 19 days ago 2 comments

Bump rack from 2.2.3 to 2.2.23

chawdamrunal/probe-lab #3

2.2.3 → 2.2.23 Patch PR

Closed 26 days ago 5 comments

Bump the bundler-production-dependencies group across 1 directory with 41 updates

Astronomy-NextGenIT/Email-Repo-opentelemetry #24

3.2.6 → 3.2.7 Patch PR

Open 27 days ago 1 comment

Bump the production-dependencies group with 53 updates

Layerrail/layerrail #181

3.2.6 → 3.2.7 Patch PR

Closed about 1 month ago 2 comments

Bump the ruby-dependencies group across 1 directory with 34 updates

dpla/dashboard-analytics #343

2.2.23 → 3.2.7 Major PR

Open about 1 month ago 2 comments

Bump the bundler-production-dependencies group across 1 directory with 38 updates

tech-deepa/Astronomy-shop #122

3.2.6 → 3.2.7 Patch PR

Closed about 2 months ago 1 comment

Bump the production-dependencies group across 1 directory with 7 updates

ubicloud/ubicloud #6444

3.2.6 → 3.2.7 Patch PR

Closed about 2 months ago 1 comment

DEPS: Bump rack from 2.2.23 to 2.2.24

UCF-CEN-5016/discourse #49

2.2.23 → 2.2.24 Patch PR

Open about 2 months ago 2 comments

Bump the dependencies group across 1 directory with 15 updates

moneybird/postgresql_validations #346

3.2.6 → 3.2.7 Patch PR

Closed about 2 months ago 1 comment

Bump the production-dependencies group with 49 updates

Layerrail/layerrail #122

3.2.6 → 3.2.7 Patch PR

Closed about 2 months ago 2 comments

Bump the production-dependencies group with 49 updates

Layerrail/layerrail #120

3.2.6 → 3.2.7 Patch PR

Closed about 2 months ago 2 comments

build(deps): bump the bundler group across 2 directories with 10 updates

burhanuddin-anw/opentelemetry-demo #488

3.1.15 → 3.2.7 Minor PR

Open 2 months ago 1 comment

chore(deps): bump the bundler-production-dependencies group across 1 directory with 35 updates

fgfusion/gitops #123

3.2.6 → 3.2.7 Patch PR

Closed 2 months ago 1 comment

Bump the bundler-dependencies group across 1 directory with 6 updates

civictechnologists/website #154

3.2.6 → 3.2.7 Patch PR

Closed 2 months ago 1 comment

Bump the production-dependencies group with 47 updates

Layerrail/layerrail #94

3.2.6 → 3.2.7 Patch PR

Closed 2 months ago 2 comments

Bump the bundler group across 9 directories with 6 updates

useplato/gitlabhq #34

2.2.4 → 2.2.23 Patch PR

Closed 6 months ago 1 comment

Bump the bundler group across 2 directories with 5 updates

SherfeyInv/devbox #175

3.2.5 → 3.2.6 Patch PR

Open 6 months ago 1 comment

Bump the ruby-dependencies group with 29 updates

dpla/dashboard-analytics #306

2.2.23 → 3.2.6 Major PR

Open 6 months ago 1 comment

Bump rack from 3.2.4 to 3.2.6

openaustralia/planningalerts #2039

3.2.4 → 3.2.6 Patch PR

Open 6 months ago 4 comments

build(deps): bump the bundler-production-dependencies group across 1 directory with 72 updates

owjoel/is469 #150

3.2.5 → 3.2.6 Patch PR

Closed 6 months ago 1 comment

Bump rack from 3.2.5 to 3.2.6

poposann0746/kebab-tokyo #160

3.2.5 → 3.2.6 Patch PR

Closed 6 months ago 1 comment

Bump rack from 2.2.9 to 2.2.23

assirims/test_gems #991

2.2.9 → 2.2.23 Patch PR

Open 7 months ago 1 comment

build(deps): bump the bundler-production-dependencies group across 1 directory with 70 updates

GuanceDemo/OpenTelemetry_Demo #72

3.2.5 → 3.2.6 Patch PR

Closed 7 months ago 1 comment

Bump the bundler-production-dependencies group across 1 directory with 71 updates

jlawton-cribl/opentelemetry-demo #123

3.2.5 → 3.2.6 Patch PR

Closed 7 months ago 1 comment

build(deps): bump rack from 3.2.4 to 3.2.6

alphagov/govuk_web_banners #224

3.2.4 → 3.2.6 Patch PR

Closed 7 months ago 1 comment

Bump rack from 3.2.5 to 3.2.6

quintel/etlocal #675

3.2.5 → 3.2.6 Patch PR

Open 7 months ago 1 comment

Bump the bundler group across 1 directory with 6 updates

Lynquatiq/entitlements-github-plugin #4

3.0.16 → 3.1.21 Minor PR

Closed 7 months ago 1 comment

Bump the bundler group across 1 directory with 3 updates

onetimesecret/onetimesecret #2934

3.2.5 → 3.2.6 Patch PR

Closed 7 months ago 2 comments

build(deps): bump the bundler group across 2 directories with 5 updates

burhanuddin-anw/opentelemetry-demo #248

3.1.15 → 3.2.6 Minor PR

Open 7 months ago 1 comment

Bump the bundler group across 1 directory with 2 updates

seahal/umaxica-apps-jit #666

3.2.5 → 3.2.6 Patch PR

Closed 7 months ago 2 comments

Bump the bundler group across 1 directory with 2 updates

onetimesecret/onetimesecret #2931

3.2.5 → 3.2.6 Patch PR

Open 7 months ago 1 comment

Bump the bundler group across 4 directories with 8 updates

waveaccounting/activeadmin #18

2.2.9 → 3.2.6 Major PR

Closed 7 months ago 1 comment

Bump rack from 3.2.5 to 3.2.6 in the bundler group across 1 directory

onetimesecret/onetimesecret #2908

3.2.5 → 3.2.6 Patch PR

Open 7 months ago 1 comment

build(deps): Bump the non-major-updates group across 1 directory with 2 updates

jesse-c/Brewfile #239

3.2.5 → 3.2.6 Patch PR

Closed 7 months ago 2 comments

Bump the bundler group across 1 directory with 8 updates

AKJUS/octopress #1

1.4.1 → 3.2.6 Major PR

Open 7 months ago 1 comment

build(deps): bump rack from 3.2.5 to 3.2.6

idylle-cynique/sample_app #23

3.2.5 → 3.2.6 Patch PR

Open 7 months ago 2 comments

Bump the bundler group across 2 directories with 2 updates

sumonst21/ort #29

2.2.3 → 2.2.23 Patch PR

Closed 7 months ago 1 comment

Bump the bundler group across 15 directories with 1 update

vitolothomas1986/gitlabhq #18

3.1.8 → 3.1.21 Patch PR

Closed 7 months ago 1 comment

build(deps): bump rack from 2.2.8 to 2.2.23 in /src/email

apache/doris-opentelemetry-demo #312

2.2.8 → 2.2.23 Patch PR

Closed 7 months ago 3 comments

Bump the bundler group across 6 directories with 1 update

cezary13k/ruby-example-applications #5

2.2.3.1 → 2.2.23 Patch PR

Closed 7 months ago 1 comment

Bump rack from 2.2.4 to 2.2.23

dragonchaser/maptool #64

2.2.4 → 2.2.23 Patch PR

Closed 7 months ago 1 comment

Bump rack from 3.2.5 to 3.2.6 in /bullet_train-roles

bullet-train-co/bullet_train-core #1407

3.2.5 → 3.2.6 Patch PR

Closed 7 months ago 1 comment

Bump rack from 3.2.5 to 3.2.6 in /bullet_train-has_uuid

bullet-train-co/bullet_train-core #1405

3.2.5 → 3.2.6 Patch PR

Closed 7 months ago 1 comment

Bump rack from 3.2.5 to 3.2.6 in /bullet_train-outgoing_webhooks

bullet-train-co/bullet_train-core #1402

3.2.5 → 3.2.6 Patch PR

Closed 7 months ago 1 comment

chore(deps): bump rack from 3.0.6.1 to 3.1.21

aptible/dryer-lint #23

3.0.6.1 → 3.1.21 Minor PR

Closed 7 months ago 2 comments

Bump rack from 2.2.3 to 2.2.23 in /3.0/test/rack-test-app

sclorg/s2i-ruby-container #638

2.2.3 → 2.2.23 Patch PR

Open 7 months ago 1 comment

Bump rack from 2.2.21 to 2.2.23 in /docker/template

decko-commons/decko #1275

2.2.21 → 2.2.23 Patch PR

Open 7 months ago 1 comment

chore: Bump rack from 2.2.22 to 2.2.23

ComPlat/chemotion_ELN #3086

2.2.22 → 2.2.23 Patch PR

Closed 7 months ago 1 comment

Bump rack from 2.2.22 to 2.2.23

DEFRA/pafs-admin #927

2.2.22 → 2.2.23 Patch PR

Closed 7 months ago 1 comment

Bump rack from 2.2.22 to 2.2.23

swobspace/adwhois #63

2.2.22 → 2.2.23 Patch PR

Closed 7 months ago 1 comment

Package Details

Name:	`rack`
Ecosystem:	rubygems
PURL Type:	gem
Package URL:	`pkg:gem/rack`
JSON API:	View JSON

Security Advisories

50

Active advisories

CRITICAL 1

HIGH 18

MODERATE 26

LOW 5

View All gem Advisories

Package Information

Description:

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Repository:	https://github.com/rack/rack
Homepage:	https://github.com/rack/rack
Latest Release:	`3.1.16` over 1 year ago
Dependent Repos:	1,043,594
Dependent Packages:	3,634
Downloads:	1,088,635,238
Ranking:	Top 0.0045% by dependent repos Top 0.0067% by downloads Top 0.0139% by dependent pkgs

PR Status

Open 4,104 (35.6%)

Merged 2,667 (23.1%)

Closed 3,119 (27.1%)

PR Types

Major 303 (2.6%)

Minor 335 (2.9%)

Patch 9,208 (79.9%)