Skip to content
Threat Feed
Subscribe

Tag

Rack

2 briefs RSS
medium advisory

Rack::Static Information Disclosure Vulnerability (CVE-2026-34785)

Rack versions prior to 2.2.23, 3.1.21, and 3.2.6 are vulnerable to information disclosure due to improper static file serving via a prefix matching issue in Rack::Static.

rack information-disclosure CVE-2026-34785 ruby webserver
2r 1t 1c
critical advisory

Rack::Session::Cookie Vulnerability Enables Secretless Session Forgery

Rack::Session::Cookie incorrectly handles decryption failures, falling back to a default decoder and allowing attackers to forge session cookies without knowing the secret, potentially leading to authentication bypass or privilege escalation in vulnerable Rack applications.

rack-session rack session cookie deserialization vulnerability privilege-escalation
2r 2t 1c