Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser

Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginx

Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length

Rack: Unbounded Range Count in get_byte_ranges Enables DoS

Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching

Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header

Rack has a Directory Traversal via Rack:Directory

Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing

Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)

Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters

Unbounded-Parameter DoS in Rack::QueryParser

Local File Inclusion in Rack::Static

Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

Possible DoS Vulnerability with Range Header in Rack

Rack ReDos in content type parsing (2nd degree polynomial)

Possible Denial of Service Vulnerability in Rack Header Parsing

A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that…

A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause…

There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1

A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0