Summary
It was discovered that Rack incorrectly handled deleted rack sessions. An
attacker could possibly use this issue to expose sensitive information or
to gain unauthorized access to user accounts. (CVE-2025-32441)
It was discovered that Rack incorrectly limited the number of parameters
in a web request. An attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04
LTS, Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04. (CVE-2025-46727)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | ruby-rack | 2.2.7-1ubuntu0.3 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | ruby-rack | 1.5.2-3+deb8u3ubuntu1~esm10 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | ruby-rack | 1.6.4-3ubuntu0.2+esm8 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | ruby-rack | 1.6.4-4ubuntu0.2+esm8 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | ruby-rack | 2.0.7-2ubuntu0.1+esm7 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | ruby-rack | 2.1.4-5ubuntu1.1+esm2 |
Vulnerabilities 2
-
High 7.5
Unbounded-Parameter DoS in Rack::QueryParser
Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, `Rack::QueryParser` parses query strings and `application/x-www-form-urlencoded` bodies into Ruby data structures without imposing any limit on the number of parameters…
-
Medium 4.2
Rack session gets restored after deletion
Rack is a modular Ruby web server interface. Prior to version 2.2.14, when using the `Rack::Session::Pool` middleware, simultaneous rack requests can restore a deleted rack session, which allows the unauthenticated user to occupy that session. Rack session mi…