Summary
Minh Pham Quang discovered that Rack did not correctly handle parsing
certain paths, which could lead to a path traversal attack. An attacker
could possibly use this issue to leak sensitive information.
(CVE-2026-22860)
Ali Firas discovered that Rack did not correctly sanitize certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2026-25500)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | ruby-rack | 2.2.7-1ubuntu0.6 |
| Ubuntu · 25.10 | ruby-rack | 3.1.16-0.1ubuntu0.2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | ruby-rack | 2.0.7-2ubuntu0.1+esm9 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | ruby-rack | 2.1.4-5ubuntu1.2+esm2 |