Description
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.select_best_encoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard (*) entries. Because this method is used by Rack::Deflater to choose a response encoding, an unauthenticated attacker can send a single request with a crafted Accept-Encoding header and cause disproportionate CPU consumption on the compression middleware path. This results in a denial of service condition for applications using Rack::Deflater. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rack | rack | < 2.2.23, >= 3.0.0.beta1, < 3.1.21, >= 3.2.0, < 3.2.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-rack | 3.2.6-2 | — |
| Debian 13 | ruby-rack | 3.1.20-0+deb13u2 | — |
| Debian 12 | ruby-rack | 2.2.22-0+deb12u2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | ruby-rack | 3.2.4-1ubuntu1.1 | USN-8989-1 |
| Ubuntu 25.10 | ruby-rack | 3.1.16-0.1ubuntu0.3 | — |
| Ubuntu 24.04 LTS | ruby-rack | 2.2.7-1ubuntu0.7 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | ruby-rack | 2.1.4-5ubuntu1.2+esm3 | — |
| Ubuntu Pro 18.04 LTS | ruby-rack | 1.6.4-4ubuntu0.2+esm10 | — |
| Ubuntu Pro 16.04 LTS | ruby-rack | 1.6.4-3ubuntu0.2+esm10 | — |
| Ubuntu Pro 14.04 LTS | ruby-rack | 1.5.2-3+deb8u3ubuntu1~esm11 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | rmt-server | 2.27-150500.3.47.1 | SUSE-SU-2026:2487-1 |
| SLES 15 SP5 | rmt-server | 2.27-150500.3.47.1 | SUSE-SU-2026:2487-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | rmt-server | 3.1.0-160000.1.1 | SUSE-SU-2026:23321-1 |
| SLES for SAP 15 SP6 | rmt-server | 2.27-150500.3.47.1 | SUSE-SU-2026:2487-1 |
| SLES for SAP 15 SP5 | rmt-server | 2.27-150500.3.47.1 | SUSE-SU-2026:2487-1 |
| SLES 16.0 | rmt-server | 3.1.0-160000.1.1 | SUSE-SU-2026:23321-1 |
| SLE HPC 15 SP5 | rmt-server | 2.27-150500.3.47.1 | SUSE-SU-2026:2487-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rubygem-rack-2.2 | 2.2.23-1.1 | openSUSE-SU-2026:10508-1 |
| openSUSE Leap 16.0 | rmt-server | 3.1.0-160000.1.1 | openSUSE-SU-2026:21640-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | kube-fluentd-operator | 1.18.2-r60 | — |
| Wolfi rolling | logstash-9.3 +2 | 9.3.3-r2 | — |
| Wolfi rolling | ruby3.2-rack-2.2 +2 | 2.2.23-r0 | — |
| Wolfi rolling | ruby3.3-rack-2.2 | 2.2.22-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | rack | < 2.2.23 | 2.2.23 | GHSA-v569-hp3g-36wr |
| RubyGems | rack | >= 3.0.0.beta1, < 3.1.21 | 3.1.21 | GHSA-v569-hp3g-36wr |
| RubyGems | rack | >= 3.2.0, < 3.2.6 | 3.2.6 | GHSA-v569-hp3g-36wr |
Advisories 6
- USN-8989-1 ruby-rack vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- SUSE-SU-2026:23321-1 Security update for rmt-server SUSE / openSUSE Security Updates · Sep 10, 2026
- WID-SEC-2026-1687 IBM License Metric Tool: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Sep 1, 2026
- openSUSE-SU-2026:21640-1 Security update for rmt-server SUSE / openSUSE Security Updates · Aug 27, 2026
- SUSE-SU-2026:2487-1 Security update for rmt-server SUSE / openSUSE Security Updates · Jun 24, 2026
- openSUSE-SU-2026:10508-1 ruby4.0-rubygem-rack-2.2-2.2.23-1.1 on GA media SUSE / openSUSE Security Updates · Apr 9, 2026