Find, fix and prevent vulnerabilities in your code.

Overview

yard is a documentation generation tool for the Ruby programming language.

Affected versions of this package are vulnerable to Directory Traversal. When using yard server to serve documentation the package would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level.

Note: The original patch in version 0.9.20 was incorrectly applied.

Remediation

Upgrade yard to version 0.9.42 or higher.

References

• GitHub Advisory
• GitHub Advisory
• GitHub Commit

Overview

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the Rack::QueryParser. An attacker can exhaust memory and CPU by sending HTTP requests containing an excessively large number of &-separated query parameters.

Workaround

This vulnerability can be avoided by any means that limits the length of incoming raw strings or application/x-www-form-urlencoded data, including application-level limitation or employing middleware.

Remediation

Upgrade rack to version 2.2.14, 3.0.16, 3.1.14 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit

Overview

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the Content-Disposition header parsing. An attacker can cause the server to consume excessive resources and potentially crash by sending specially crafted requests that exploit this inefficiency.

Remediation

Upgrade rack to version 3.1.16 or higher.

References

• GitHub Commit
• GitHub Commit

Overview

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Rack::Multipart::Parser. An attacker can exhaust system memory and cause process termination or severe slowdown by sending multipart requests with headers that never terminate, leading to unbounded memory allocation.

Workaround

This vulnerability can be mitigated by restricting maximum request sizes at the proxy or web server layer, such as configuring Nginx with client_max_body_size.

Remediation

Upgrade rack to version 2.2.19, 3.1.17, 3.2.2 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit

Overview

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Rack::Multipart::Parser. An attacker can exhaust system memory by sending multipart form submissions with excessively large non-file fields, leading to process crashes or degraded performance due to memory exhaustion and increased garbage collection overhead.

Workaround

This vulnerability can be mitigated by restricting the maximum request body size at the web-server or proxy layer (such as configuring Nginx client_max_body_size) and by validating and rejecting unusually large form fields at the application level.

Remediation

Upgrade rack to version 2.2.19, 3.1.17, 3.2.2 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit

Overview

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Rack::Multipart::Parser. An attacker can cause excessive memory consumption and potential process termination by sending multipart/form-data requests with a large preamble, leading to significant memory spikes and possible denial of service. The impact increases with higher allowed request sizes and concurrency.

Workaround

This vulnerability can be mitigated by limiting the total request body size at the proxy or web server level and by monitoring memory usage and setting per-process memory limits to prevent out-of-memory conditions.

Remediation

Upgrade rack to version 2.2.19, 3.1.17, 3.2.2 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit

Overview

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Rack::Request#POST process. An attacker can exhaust system memory by sending large application/x-www-form-urlencoded request bodies, causing application slowdowns or termination by the operating system due to out-of-memory conditions. This occurs before any parameter parsing or configured parsing limits are enforced, allowing unbounded memory allocation proportional to the request size and concurrency.

Workaround

This vulnerability can be mitigated by enforcing strict maximum body size at the proxy or web server layer, such as configuring Nginx client_max_body_size or Apache LimitRequestBody.

Remediation

Upgrade rack to version 3.2.3, 3.1.18, 2.2.20 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit

Overview

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Denial of Service (DoS) via the Rack::Utils.select_best_encoding component. An attacker can cause excessive CPU consumption by sending a specially crafted Accept-Encoding header containing multiple wildcard entries.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade rack to version 2.2.23, 3.1.21, 3.2.6 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Denial of Service (DoS) through the get_byte_ranges function. An attacker can exhaust CPU, memory, I/O, and bandwidth resources by sending requests with numerous small overlapping byte ranges in the HTTP Range header.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade rack to version 2.2.23, 3.1.21, 3.2.6 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Denial of Service (DoS) when handling multipart form data without a Content-Length header in the Rack::Multipart::Parser component. An attacker can exhaust disk space by streaming an arbitrarily large multipart file upload, leading to service disruption.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade rack to version 2.2.23, 3.1.21, 3.2.6 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the handle_mime_head component. An attacker can cause excessive CPU consumption by sending a crafted multipart/form-data request with numerous parts containing long, escape-heavy quoted parameter values.

Remediation

Upgrade rack to version 3.1.21, 3.2.6 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Partial String Comparison in the Rack::Static component when URL prefix matching is used to determine if a request should be served as a static file. An attacker can access unintended files by crafting request paths that share the configured prefix, potentially leading to unauthorized disclosure of sensitive information.

Remediation

Upgrade rack to version 2.2.23, 3.1.21, 3.2.6 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Affected versions of this package are vulnerable to Permissive Regular Expression in the map_accel_path component. An attacker can read arbitrary files by injecting specially crafted values into the HTTP_X_ACCEL_MAPPING header, which are then interpolated into a regular expression and used to rewrite file paths for X-Accel-Redirect responses in nginx.

Remediation

Upgrade rack to version 2.2.23, 3.1.21, 3.2.6 or higher.

References

• GitHub Advisory
• GitHub Commit

Overview

Affected versions of this package are vulnerable to OS Command Injection via the merge tool. An attacker can execute arbitrary commands by supplying crafted input that is improperly handled during the construction of commands.

Remediation

Upgrade thor to version 1.4.0 or higher.

References

• GitHub Commit
• GitHub PR