-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 01 Sep 2026 10:05:17 +0530 Source: ruby-rack Binary: ruby-rack Architecture: source all Version: 3.1.20-0+deb13u2 Distribution: trixie-security Urgency: high Maintainer: Debian Ruby Team <[email protected]> Changed-By: Abhijith PA <[email protected]> Description: ruby-rack - modular Ruby webserver interface Changes: ruby-rack (3.1.20-0+deb13u2) trixie-security; urgency=high . * Team upload * CVE-2026-26961: Greedy multipart boundary parsing can cause parser differentials and WAF bypass. * CVE-2026-26962: Improper unfolding of folded multipart headers preserves CRLF in parsed parameter values. * CVE-2026-32762: `Forwarded` header semicolon injection enables `Host` and `Scheme` spoofing * CVE-2026-34230: Quadratic complexity in `Rack::Utils.select_best_encoding` via wildcard `Accept-Encoding` header. * CVE-2026-34763: Root directory disclosure via unescaped regex interpolation * CVE-2026-34785: `Rack::Static` prefix matching can expose unintended files under the static root. * CVE-2026-34786: `Rack::Static` `header_rules` bypass via URL-encoded path mismatch. * CVE-2026-34826: Multipart byte range processing allows denial of service via excessive overlapping ranges * CVE-2026-34827: Multipart header parsing allows denial of service via escape-heavy quoted parameters * CVE-2026-34829: Multipart parsing without `Content-Length` header allows unbounded chunked file uploads * CVE-2026-34830: `Rack::Sendfile` header-based `X-Accel-Mapping` regex injection enables unauthorized `X-Accel-Redirect`. * CVE-2026-34831: `Content-Length` mismatch in `Rack::Files` error responses. * CVE-2026-34835: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass. Checksums-Sha1: f73b2a4a7c1e4014874d9c5028c663ac0d18d398 2395 ruby-rack_3.1.20-0+deb13u2.dsc 65bee2af59b08e4188e98ce097b4931dc4d17619 798434 ruby-rack_3.1.20.orig.tar.gz f0800e2bcb27e87d46d7baa21452f6fede33b13b 20440 ruby-rack_3.1.20-0+deb13u2.debian.tar.xz d78e84a3319b2f5140a466962f58c864a11d630b 101840 ruby-rack_3.1.20-0+deb13u2_all.deb 00dde2f0f4cd44c8e468ee60a8c80002106924e3 8820 ruby-rack_3.1.20-0+deb13u2_amd64.buildinfo Checksums-Sha256: a61759838e4f4926c6255a0d82b391ba79984c2c39c9b601d0d4b7818ad50b54 2395 ruby-rack_3.1.20-0+deb13u2.dsc 6980815e884ba550b5d59a2feaa0a0d283813ae0a695bf35dde4a6242d418805 798434 ruby-rack_3.1.20.orig.tar.gz bb93fe6033faa0668d02abcfc2002ef5d3e59d8ea0ff182081f41afc215117cb 20440 ruby-rack_3.1.20-0+deb13u2.debian.tar.xz 09c43bf5d13b8e297f068e3a85958a37207a6a6e01de2e29563433249183ae19 101840 ruby-rack_3.1.20-0+deb13u2_all.deb 69a4ebb13cbea51a3eafab9ae618d4cb2f64f3f86b3433a0c4b10ada9728f259 8820 ruby-rack_3.1.20-0+deb13u2_amd64.buildinfo Files: 7d4b924ce53aad0d0520aaaa7ee8bb11 2395 ruby optional ruby-rack_3.1.20-0+deb13u2.dsc c8f9aff604cefa4d204480294b03a3b6 798434 ruby optional ruby-rack_3.1.20.orig.tar.gz af4f64c5a1478c6b8042f37e28ab4dc3 20440 ruby optional ruby-rack_3.1.20-0+deb13u2.debian.tar.xz ddc03bd358ee5362b5acdaf8ec25bffa 101840 ruby optional ruby-rack_3.1.20-0+deb13u2_all.deb 20f5a28bc14b4607d9b8c478d3eb2bfe 8820 ruby optional ruby-rack_3.1.20-0+deb13u2_amd64.buildinfo
-----BEGIN PGP SIGNATURE----- iQJIBAEBCgAyFiEE7xPqJqaY/zX9fJAuhj1N8u2cKO8FAmqiKmMUHGFiaGlqaXRo QGRlYmlhbi5vcmcACgkQhj1N8u2cKO/puQ//V7ThPIwdnGmLbOqmyOKRRAswgBRa kaXTRZGpra0l1878P9gImZHCB9mcNz5sdDZbaVJYvEMXDpTZB4ag8kCidjddMEyO enSqh1kVJxai5Ju/ulU1MZZlYKapuKr7Yd0zbnnG79IFqdQNqZkNbIOYpf3Kb5Nx STGXL3djmexH1mVf5mrmKxPf+CYhrCVxTzvRJLKVA9rxZ7OM8bAlm78TRfUa6cuQ GDj0A8tmKw6sH0pxEz/K4wEnGaH0cE+Xa2Q1E4oldw743Hy1qiQa0SgYEhmERbD8 wQ/2J8NV+s4pOHP9yIwvyyewsYca0EjLPrQth+lGUQmLGKcOz+3ndJgGSIzkKS0F hHmNIaQQJQEZ4KL0lKAW3O9V9+mPICtGD1P02UxaQ4YsTgtk6ArNtnrFtJKfGFzM PKs6nQnwetCcI4AgkrTn9hdc7DQI1d0cA2ZMszvoERMRGDg0FytXZaS2C0ygY5ht nJ0PnMXUQFS3Jq1/iTVmu9EsGPpa2PZMZkkvCwUNRPhzwvmZagb7UMTw0T2DzI87 VndfZlVljhp1H/5JCJhNZi9exb36Gn3lnAfd/vHtM8Ur+zp8VnNHzIUYTh048b00 8G/9aWOZNJxyUiqj9lT4QPhz5lvFIl52N1NQQUbNDLnc0WyL9ieG2IbCEXQ6y4fh tj6Wga+eoJUT0kE= =Mg1B -----END PGP SIGNATURE-----
pgpN21E7dJqlW.pgp
Description: PGP signature
