# Rack vulnerabilities

Source: https://junglewise.ai/threats/vendors/rack  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 12 November 2026, 20:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/rack.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 17 vulnerabilities in Rack: 2 in the last 7 days and 2 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-125111, was published on 9 November 2026. Nothing was published in the last eight weeks.

## Counts

- Last 7 days: 2
- Last 30 days: 2
- Last 90 days: 2
- All time: 17 (1 critical, 0 exploited in the wild)

## About Rack

Ruby web application framework for building web services.

## Latest Rack vulnerabilities

- [CVE-2026-125111: Rack multipart parser denial of service via unbounded scan buffer growth](https://junglewise.ai/threats/cve-2026-125111-rack-multipart-parsing-allows-dos-via-unbounded-scan-buffer) (high, CVSS 7.5, published 9 Nov 2026)
- [CVE-2026-125109: Rack host validation bypass via HTTP headers](https://junglewise.ai/threats/cve-2026-125109-rack-is-a-modular-ruby-web-server-interface-from-3-0-until-3-1) (medium, CVSS 4.8, published 9 Nov 2026)
- [CVE-2026-39324: Rack rack-session auth bypass and deserialization in Session Cookie](https://junglewise.ai/threats/cve-2026-39324-rack-rack-session-auth-bypass-and-deserialization-in-session) (critical, CVSS 9.8, published 7 Apr 2026)
- [CVE-2026-34835: Rack Rack::Request host allowlist bypass via Host header poisoning](https://junglewise.ai/threats/cve-2026-34835-rack-rack-request-host-allowlist-bypass-via-host-header-poisoning) (medium, CVSS 4.8, published 2 Apr 2026)
- [CVE-2026-34827: Rack algorithmic complexity denial of service in Multipart Parser](https://junglewise.ai/threats/cve-2026-34827-rack-algorithmic-complexity-denial-of-service-in-multipart-parser) (high, CVSS 7.5, published 2 Apr 2026)
- [CVE-2026-32762: Rack interpretation conflict in Forwarded header parsing](https://junglewise.ai/threats/cve-2026-32762-rack-interpretation-conflict-in-forwarded-header-parsing) (medium, CVSS 4.8, published 2 Apr 2026)
- [CVE-2026-26962: Rack CRLF injection in Rack::Multipart::Parser](https://junglewise.ai/threats/cve-2026-26962-rack-crlf-injection-in-rack-multipart-parser) (medium, CVSS 4.8, published 2 Apr 2026)
- [CVE-2026-34831: Rack incorrect Content-Length calculation in Rack::Files error responses](https://junglewise.ai/threats/cve-2026-34831-rack-incorrect-content-length-calculation-in-rack-files-error) (medium, CVSS 4.8, published 2 Apr 2026)
- [CVE-2026-34830: Rack Rack regular expression injection in Rack::Sendfile](https://junglewise.ai/threats/cve-2026-34830-rack-rack-regular-expression-injection-in-rack-sendfile) (medium, CVSS 5.9, published 2 Apr 2026)
- [CVE-2026-34829: Rack uncontrolled resource consumption in Rack::Multipart::Parser](https://junglewise.ai/threats/cve-2026-34829-rack-uncontrolled-resource-consumption-in-rack-multipart-parser) (high, CVSS 7.5, published 2 Apr 2026)
- [CVE-2026-34826: Rack denial of service via excessive overlapping HTTP byte ranges](https://junglewise.ai/threats/cve-2026-34826-rack-denial-of-service-via-excessive-overlapping-http-byte-ranges) (medium, CVSS 5.3, published 2 Apr 2026)
- [CVE-2026-34786: Rack Rack::Static security header bypass via URL-encoded paths](https://junglewise.ai/threats/cve-2026-34786-rack-rack-static-security-header-bypass-via-url-encoded-paths) (medium, CVSS 5.3, published 2 Apr 2026)
- [CVE-2026-34785: Rack Rack::Static information disclosure via partial string matching](https://junglewise.ai/threats/cve-2026-34785-rack-rack-static-information-disclosure-via-partial-string) (high, CVSS 7.5, published 2 Apr 2026)
- [CVE-2026-34763: Rack Rack::Directory information disclosure via unescaped regex interpolation](https://junglewise.ai/threats/cve-2026-34763-rack-rack-directory-information-disclosure-via-unescaped-regex) (medium, CVSS 5.3, published 2 Apr 2026)
- [CVE-2026-34230: Rack inefficient algorithmic complexity in Rack::Utils.select_best_encoding](https://junglewise.ai/threats/cve-2026-34230-rack-inefficient-algorithmic-complexity-in-rack-utils-select-best) (high, CVSS 7.5, published 2 Apr 2026)
- [CVE-2026-26961: Rack interpretation conflict in Multipart Parser boundary extraction](https://junglewise.ai/threats/cve-2026-26961-rack-interpretation-conflict-in-multipart-parser-boundary) (medium, CVSS 5.3, published 2 Apr 2026)
- [CVE-2026-22860: Rack directory traversal in Rack::Directory](https://junglewise.ai/threats/cve-2026-22860-rack-directory-traversal-in-rack-directory) (high, CVSS 7.5, published 18 Feb 2026)

## Most severe Rack vulnerabilities

- [CVE-2026-39324: Rack rack-session auth bypass and deserialization in Session Cookie](https://junglewise.ai/threats/cve-2026-39324-rack-rack-session-auth-bypass-and-deserialization-in-session) (critical, CVSS 9.8, published 7 Apr 2026)
- [CVE-2026-22860: Rack directory traversal in Rack::Directory](https://junglewise.ai/threats/cve-2026-22860-rack-directory-traversal-in-rack-directory) (high, CVSS 7.5, published 18 Feb 2026)
- [CVE-2026-34827: Rack algorithmic complexity denial of service in Multipart Parser](https://junglewise.ai/threats/cve-2026-34827-rack-algorithmic-complexity-denial-of-service-in-multipart-parser) (high, CVSS 7.5, published 2 Apr 2026)
- [CVE-2026-34829: Rack uncontrolled resource consumption in Rack::Multipart::Parser](https://junglewise.ai/threats/cve-2026-34829-rack-uncontrolled-resource-consumption-in-rack-multipart-parser) (high, CVSS 7.5, published 2 Apr 2026)
- [CVE-2026-34785: Rack Rack::Static information disclosure via partial string matching](https://junglewise.ai/threats/cve-2026-34785-rack-rack-static-information-disclosure-via-partial-string) (high, CVSS 7.5, published 2 Apr 2026)
- [CVE-2026-34230: Rack inefficient algorithmic complexity in Rack::Utils.select_best_encoding](https://junglewise.ai/threats/cve-2026-34230-rack-inefficient-algorithmic-complexity-in-rack-utils-select-best) (high, CVSS 7.5, published 2 Apr 2026)
- [CVE-2026-125111: Rack multipart parser denial of service via unbounded scan buffer growth](https://junglewise.ai/threats/cve-2026-125111-rack-multipart-parsing-allows-dos-via-unbounded-scan-buffer) (high, CVSS 7.5, published 9 Nov 2026)
- [CVE-2026-34830: Rack Rack regular expression injection in Rack::Sendfile](https://junglewise.ai/threats/cve-2026-34830-rack-rack-regular-expression-injection-in-rack-sendfile) (medium, CVSS 5.9, published 2 Apr 2026)
- [CVE-2026-34826: Rack denial of service via excessive overlapping HTTP byte ranges](https://junglewise.ai/threats/cve-2026-34826-rack-denial-of-service-via-excessive-overlapping-http-byte-ranges) (medium, CVSS 5.3, published 2 Apr 2026)
- [CVE-2026-34786: Rack Rack::Static security header bypass via URL-encoded paths](https://junglewise.ai/threats/cve-2026-34786-rack-rack-static-security-header-bypass-via-url-encoded-paths) (medium, CVSS 5.3, published 2 Apr 2026)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 2 | 0 | 0 |

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Rack vulnerabilities", https://junglewise.ai/threats/vendors/rack, 12 November 2026.