rubygem-rack (SUSE:Linux Enterprise High Availability Extension 15 SP3) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise High Availability Extension 15 SP3 package rubygem-rack, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (19)

• CVE-2022-30123 — CVSS 10.0 (critical): A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint…
• CVE-2020-8161 — CVSS 8.6 (high): A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the…
• CVE-2022-30122 — CVSS 7.5 (high): A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.
• CVE-2022-44570 — CVSS 7.5 (high): A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range…
• CVE-2022-44571 — CVSS 7.5 (high): There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1…
• CVE-2022-44572 — CVSS 7.5 (high): A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an…
• CVE-2023-27530 — CVSS 7.5 (high): A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could…
• CVE-2025-61919 — CVSS 7.5 (high): Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, `Rack::Request#POST` reads the entire request…
• CVE-2020-8184 — CVSS 7.5 (high): A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is…
• CVE-2025-27111 — CVSS 7.5 (high): Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header…
• CVE-2025-27610 — CVSS 7.5 (high): Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve…
• CVE-2025-46727 — CVSS 7.5 (high): Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, `Rack::QueryParser` parses query strings and…
• CVE-2025-25184 — CVSS 6.5 (medium): Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be…
• CVE-2025-61780 — CVSS 5.8 (medium): Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, a possible information disclosure vulnerability…
• CVE-2024-26141 — CVSS 5.8 (medium): Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large…
• CVE-2024-26146 — CVSS 5.3 (medium): Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected…
• CVE-2023-27539 — CVSS 5.3 (medium): There is a denial of service vulnerability in the header parsing component of Rack.
• CVE-2024-25126 — CVSS 5.3 (medium): Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much…
• CVE-2025-32441 — CVSS 4.2 (medium): Rack is a modular Ruby web server interface. Prior to version 2.2.14, when using the `Rack::Session::Pool` middleware, simultaneous rack…