Количество 10
Количество 10
BDU:2026-07734
Уязвимость модульного интерфейса веб-сервера Rack языка программирования Ruby, позволяющая нарушителю обойти ограничения безопасности
ROS-20260513-73-0005
Уязвимость rubygem-rack
CVE-2026-26961
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
CVE-2026-26961
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
CVE-2026-26961
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
CVE-2026-26961
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, ...
GHSA-vgpv-f759-9wx3
Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass.
SUSE-SU-2026:2487-1
Security update for rmt-server
SUSE-SU-2026:1964-1
Security update for rmt-server
SUSE-SU-2026:1745-1
Security update for rmt-server
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | BDU:2026-07734 Уязвимость модульного интерфейса веб-сервера Rack языка программирования Ruby, позволяющая нарушителю обойти ограничения безопасности | CVSS3: 5.3 | 0% Низкий | 4 месяца назад |
 | ROS-20260513-73-0005 Уязвимость rubygem-rack | CVSS3: 5.3 | 0% Низкий | 3 месяца назад |
 | CVE-2026-26961 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6. | CVSS3: 3.7 | 0% Низкий | 4 месяца назад |
 | CVE-2026-26961 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6. | CVSS3: 3.7 | 0% Низкий | 4 месяца назад |
 | CVE-2026-26961 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6. | CVSS3: 3.7 | 0% Низкий | 4 месяца назад |
| CVE-2026-26961 Rack is a modular Ruby web server interface. Prior to versions 2.2.23, ... | CVSS3: 3.7 | 0% Низкий | 4 месяца назад |
| GHSA-vgpv-f759-9wx3 Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass. | CVSS3: 5.3 | 0% Низкий | 4 месяца назад |
 | SUSE-SU-2026:2487-1 Security update for rmt-server | около 1 месяца назад | ||
| SUSE-SU-2026:1964-1 Security update for rmt-server | 3 месяца назад | ||
| SUSE-SU-2026:1745-1 Security update for rmt-server | 3 месяца назад |
Уязвимостей на страницу