Four new rack advisories

gems/rack/GHSA-2j8w-xcrc-x985.yml

@@ -0,0 +1,52 @@
+---
+gem: rack
+ghsa: 2j8w-xcrc-x985
+url: https://github.com/rack/rack/security/advisories/GHSA-2j8w-xcrc-x985
+title: Rack::Request#host_with_port and `#base_url` return an
+  invalid `Host` verbatim, enabling URL and allowlist bypass
+date: 2026-10-30
+description: |
+  Rack::Request#host_with_port, and therefore #base_url and #url,
+  return the raw authority string when it fails validation. An
+  attacker-controlled Host, X-Forwarded-Host, or Forwarded:
+  host= value containing characters that are not permitted in an
+  authority is embedded verbatim in URLs generated by the application.
+
+  This completes the fix for CVE-2026-34835 (GHSA-g2pf-xv49-m2h5),
+  which made #host and #hostname return nil for an invalid authority
+  but left this path unchanged.
+
+  ## Impact
+
+  Applications that build absolute URLs, redirects, or origin-dependent
+  checks from req.url, req.base_url, or req.host_with_port, and that
+  do not enforce a host allowlist, may emit URLs containing attacker-chosen
+  characters such as @, /, ?, #, spaces, or angle brackets. Generated
+  links and Location headers can be redirected through userinfo tricks,
+  string-based URL checks can be bypassed, and markup is reflected
+  where the application does not escape the value. For example, redirect
+  in Sinatra behind a proxy that forwards X-Forwarded-Host emits the
+  raw invalid authority in Location.
+
+  Rails overrides these methods in Action Dispatch and is not expected
+  to be affected. Rack 3.1 and 3.2 are affected. Rack 2.2 did not
+  receive the CVE-2026-34835 change and returns the raw value from
+  every host method.
+cvss_v3: 4.8
+unaffected_versions:
+  - "< 3.0.0.beta1"
+patched_versions:
+  - "~> 3.1.23"
+  - ">= 3.2.8"
+related:
+  url:
+    - https://rubygems.org/gems/rack/versions/3.2.8
+    - https://github.com/rack/rack/blob/main/CHANGELOG.md#328---2026-10-30
+    - https://rubygems.org/gems/rack/versions/3.1.23
+    - https://github.com/rack/rack/blob/main/CHANGELOG.md#3123---2026-10-30
+    - https://rubygems.org/gems/rack/versions/2.2.25
+    - https://github.com/rack/rack/blob/main/CHANGELOG.md#2225---2026-10-30
+    - https://github.com/rack/rack/security/advisories/GHSA-2j8w-xcrc-x985
+notes: |
+  - cvss_v3 from GHSA URL.
+  - No CVE in GHSA URL.

gems/rack/GHSA-5v64-555j-wjxm.yml

@@ -0,0 +1,43 @@
+---
+gem: rack
+ghsa: 5v64-555j-wjxm
+url: https://github.com/rack/rack/security/advisories/GHSA-5v64-555j-wjxm
+title: Multipart parser retains parsed data in its scan buffer,
+  allowing denial of service via memory exhaustion.
+date: 2026-10-30
+description: |
+  Rack::Multipart::Parser reads the request body in chunks of
+  rack.multipart.buffer_size (1 MiB by default) into an internal
+  scan buffer. Parsed bytes are only discarded from that buffer
+  when a chunk ends inside a part body. A request whose parts are
+  sized so that every chunk ends inside, or immediately after, a
+  part's headers is never compacted, so the buffer grows to the
+  size of the request.
+
+  This results in a denial of service condition through memory
+  exhaustion for applications that parse multipart requests.
+
+  ## Impact
+
+  Any application that parses multipart requests with Rack is affected
+  in its default configuration. An unauthenticated attacker can cause
+  a single request to hold memory proportional to its size for the
+  duration of parsing, exhausting worker memory. The attack requires
+  only a well-formed multipart body.
+cvss_v3: 7.5
+patched_versions:
+  - "~> 2.2.25"
+  - "~> 3.1.23"
+  - ">= 3.2.8"
+related:
+  url:
+    - https://rubygems.org/gems/rack/versions/3.2.8
+    - https://github.com/rack/rack/blob/main/CHANGELOG.md#328---2026-10-30
+    - https://rubygems.org/gems/rack/versions/3.1.23
+    - https://github.com/rack/rack/blob/main/CHANGELOG.md#3123---2026-10-30
+    - https://rubygems.org/gems/rack/versions/2.2.25
+    - https://github.com/rack/rack/blob/main/CHANGELOG.md#2225---2026-10-30
+    - https://github.com/rack/rack/security/advisories/GHSA-5v64-555j-wjxm
+notes: |
+  - cvss_v3 from GHSA URL.
+  - No CVE in GHSA URL.

gems/rack/GHSA-p8x9-v4hv-2w4g.yml

@@ -0,0 +1,42 @@
+---
+gem: rack
+ghsa: p8x9-v4hv-2w4g
+url: https://github.com/rack/rack/security/advisories/GHSA-p8x9-v4hv-2w4g
+title: Multipart boundary guard skips a leading empty or quoted
+  `boundary` parameter, allowing parser differentials and WAF bypass
+date: 2026-10-30
+description: |
+  The guard added for CVE-2026-26961 (GHSA-vgpv-f759-9wx3), which
+  rejects multipart requests with more than one boundary parameter,
+  only inspects the part of the Content-Type header after the boundary
+  it extracts. A Content-Type whose first boundary parameter is empty
+  or begins with a quote, semicolon, or comma is skipped by the
+  extraction pattern, so a second boundary parameter is accepted
+  silently and Rack parses the body with a boundary that a conforming
+  parser would not derive from the header.
+
+  ## Impact
+
+  As with CVE-2026-26961, an attacker can craft a multipart request that
+  a web application firewall or other inspecting proxy in front of a
+  Rack application interprets differently from Rack, so form fields
+  and file uploads reach the application without inspection. Rack
+  itself grants no capability beyond that of a well-formed request with
+  the same body. All supported versions, including 2.2, are affected.
+cvss_v3: 3.7
+patched_versions:
+  - "~> 2.2.25"
+  - "~> 3.1.23"
+  - ">= 3.2.8"
+related:
+  url:
+    - https://rubygems.org/gems/rack/versions/3.2.8
+    - https://github.com/rack/rack/blob/main/CHANGELOG.md#328---2026-10-30
+    - https://rubygems.org/gems/rack/versions/3.1.23
+    - https://github.com/rack/rack/blob/main/CHANGELOG.md#3123---2026-10-30
+    - https://rubygems.org/gems/rack/versions/2.2.25
+    - https://github.com/rack/rack/blob/main/CHANGELOG.md#2225---2026-10-30
+    - https://github.com/rack/rack/security/advisories/GHSA-p8x9-v4hv-2w4g
+notes: |
+  - cvss_v3 from GHSA URL.
+  - No CVE in GHSA URL.

gems/rack/GHSA-wvg4-6p58-3gh3.yml

@@ -0,0 +1,45 @@
+---
+gem: rack
+ghsa: wvg4-6p58-3gh3
+url: https://github.com/rack/rack/security/advisories/GHSA-wvg4-6p58-3gh3
+title: Rack::Static `header_rules` bypass via unnormalized
+  dot segments in the request path
+date: 2026-10-30
+description: |
+  Rack::Static normalizes the request path with Utils.clean_path_info
+  when deciding which file to serve, but matches header_rules against
+  a path that is only URL-decoded. A request containing dot segments,
+  raw or percent-encoded, is served the normalized target file while
+  the header rules for that file's location are not applied.
+
+  This allows an attacker to receive a protected static file without
+  the security headers configured for it.
+
+  ## Impact
+
+  Applications that use Rack::Static header_rules to attach
+  security-relevant headers to particular paths or file types are
+  affected. An unauthenticated attacker who knows the path of a
+  protected file can request it through a dot segment path and
+  receive it without those headers, for example without
+  Content-Disposition: attachment or a restrictive Content-Security-Policy
+  that prevents uploaded HTML from rendering inline. The file itself
+  is served unchanged. Applications that do not use path-specific
+  header_rules are not affected.
+cvss_v3: 5.3
+patched_versions:
+  - "~> 2.2.25"
+  - "~> 3.1.23"
+  - ">= 3.2.8"
+related:
+  url:
+    - https://rubygems.org/gems/rack/versions/3.2.8
+    - https://github.com/rack/rack/blob/main/CHANGELOG.md#328---2026-10-30
+    - https://rubygems.org/gems/rack/versions/3.1.23
+    - https://github.com/rack/rack/blob/main/CHANGELOG.md#3123---2026-10-30
+    - https://rubygems.org/gems/rack/versions/2.2.25
+    - https://github.com/rack/rack/blob/main/CHANGELOG.md#2225---2026-10-30
+    - https://github.com/rack/rack/security/advisories/GHSA-wvg4-6p58-3gh3
+notes: |
+  - cvss_v3 from GHSA URL.
+  - No CVE in GHSA URL.