lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ruby-rack | Jul 30, 2024 | Jul 26, 2015 |
| Freebsd | — | Upgrade rubygem-rack15Upgrade rubygem-rackUpgrade rubygem-activesupportUpgrade rubygem-jquery-rails4Upgrade rubygem-activesupport4Upgrade rubygem-jquery-railsUpgrade rubygem-rails4Upgrade rubygem-railsUpgrade rubygem-web-consoleUpgrade rubygem-rack16 | Dec 10, 2025 | Jun 17, 2015 |
| Suse | — | Upgrade rubygem-rack-1_4Upgrade ruby2.5-rubygem-rackUpgrade rubygem-rackUpgrade ruby2.1-rubygem-rack-1_4 | Dec 18, 2015 | Jul 26, 2015 |
| Ubuntu | — | Upgrade ruby-rack | Nov 19, 2024 | Jul 26, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub