# \#rack

**URL:** https://discuss.rubyonrails.org/tag/rack/18.md

[Latest](https://discuss.rubyonrails.org/latest.md) · [Categories](https://discuss.rubyonrails.org/categories.md) · [Tags](https://discuss.rubyonrails.org/tags.md)

---

## [Rails on Rack does not mention version compatability](https://discuss.rubyonrails.org/t/rails-on-rack-does-not-mention-version-compatability/87961)

<div class="topic-metadata">

**Author:** [@Kurt\_Werle](https://discuss.rubyonrails.org/u/Kurt_Werle)\
**Replies:** 0\
**Last updated:** [November 18, 2024, 4:36pm UTC](https://discuss.rubyonrails.org/t/rails-on-rack-does-not-mention-version-compatability/87961 "2024-11-18T16:36:33Z")

</div>

does not mention which versions of rails work with various versions of rack. This makes me sad. I was surprised to learn that rails 7 does not work with rack 3. Especially because they were both mentioned in the sam…

---

## [Possible Denial of Service Vulnerability in Rack Header Parsing](https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942)

<div class="topic-metadata">

**Author:** [@tenderlove](https://discuss.rubyonrails.org/u/tenderlove)\
**Replies:** 0\
**Last updated:** [February 21, 2024, 8:32pm UTC](https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942 "2024-02-21T20:32:24Z")

</div>

There is a possible denial of service vulnerability in the header parsing routines in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26146. Versions Affected: All. Not affected: None Fixe…

---

## [Denial of Service Vulnerability in Rack Content-Type Parsing](https://discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941)

<div class="topic-metadata">

**Author:** [@tenderlove](https://discuss.rubyonrails.org/u/tenderlove)\
**Replies:** 0\
**Last updated:** [February 21, 2024, 8:30pm UTC](https://discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941 "2024-02-21T20:30:23Z")

</div>

There is a possible denial of service vulnerability in the content type parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2024-25126. Versions Affected: \>= 0.4 Not affected: \<…

---

## [Possible DoS Vulnerability with Range Header in Rack](https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944)

<div class="topic-metadata">

**Author:** [@tenderlove](https://discuss.rubyonrails.org/u/tenderlove)\
**Replies:** 0\
**Last updated:** [February 21, 2024, 8:37pm UTC](https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944 "2024-02-21T20:37:01Z")

</div>

There is a possible DoS vulnerability relating to the Range request header in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141. Versions Affected: \>= 1.3.0. Not affected: \< 1.3.0 Fixe…

---

## [CORS and the \_method parameter](https://discuss.rubyonrails.org/t/cors-and-the-method-parameter/83808)

<div class="topic-metadata">

**Author:** [@Earlopain](https://discuss.rubyonrails.org/u/Earlopain)\
**Replies:** 0\
**Last updated:** [September 27, 2023, 10:09am UTC](https://discuss.rubyonrails.org/t/cors-and-the-method-parameter/83808 "2023-09-27T10:09:42Z")

</div>

Our site has CORS set up to allow “simple requests”, i.e. the GET/POST/HEAD http methods. However I was recently made aware that the \_method parameter exists and its interaction with CORS to basically allow anyone to mak…

---

## [Request start log messages should use ActiveSupport::LogSubscriber in Rails::Rack::Logger](https://discuss.rubyonrails.org/t/request-start-log-messages-should-use-activesupport-logsubscriber-in-rails-logger/83247)

<div class="topic-metadata">

**Author:** [@sled](https://discuss.rubyonrails.org/u/sled)\
**Replies:** 0\
**Last updated:** [July 14, 2023, 3:22pm UTC](https://discuss.rubyonrails.org/t/request-start-log-messages-should-use-activesupport-logsubscriber-in-rails-logger/83247 "2023-07-14T15:22:18Z")

</div>

Currently the following log message Started GET "/something" for 127.0.0.1 at 2023-07-14 09:52:04 +0200" is directly logged in Rails::Rack::Logger using Rails.logger.info in railties/lib/rails/rack/logger.rb This pos…

---

## [\[CVE-2022-44572\] Possible Denial of Service Vulnerability in Rack's RFC2183 boundary parsing](https://discuss.rubyonrails.org/t/cve-2022-44572-possible-denial-of-service-vulnerability-in-racks-rfc2183-boundary-parsing/82124)

<div class="topic-metadata">

**Author:** [@tenderlove](https://discuss.rubyonrails.org/u/tenderlove)\
**Replies:** 0\
**Last updated:** [January 17, 2023, 9:12pm UTC](https://discuss.rubyonrails.org/t/cve-2022-44572-possible-denial-of-service-vulnerability-in-racks-rfc2183-boundary-parsing/82124 "2023-01-17T21:12:50Z")

</div>

There is a denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44572. Versions Affected: \>= 2.0.0 Not affected: None. Fixed…

---

## [\[CVE-2022-44571\] Possible Denial of Service Vulnerability in Rack Content-Disposition parsing](https://discuss.rubyonrails.org/t/cve-2022-44571-possible-denial-of-service-vulnerability-in-rack-content-disposition-parsing/82126)

<div class="topic-metadata">

**Author:** [@tenderlove](https://discuss.rubyonrails.org/u/tenderlove)\
**Replies:** 0\
**Last updated:** [January 17, 2023, 9:25pm UTC](https://discuss.rubyonrails.org/t/cve-2022-44571-possible-denial-of-service-vulnerability-in-rack-content-disposition-parsing/82126 "2023-01-17T21:25:41Z")

</div>

There is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44571. Versions Affected: \>= 2.0.0 Not affected: N…

---

## [\[CVE-2022-44570\] Possible Denial of Service Vulnerability in Rack's Range header parsing](https://discuss.rubyonrails.org/t/cve-2022-44570-possible-denial-of-service-vulnerability-in-racks-range-header-parsing/82125)

<div class="topic-metadata">

**Author:** [@tenderlove](https://discuss.rubyonrails.org/u/tenderlove)\
**Replies:** 0\
**Last updated:** [January 17, 2023, 9:23pm UTC](https://discuss.rubyonrails.org/t/cve-2022-44570-possible-denial-of-service-vulnerability-in-racks-range-header-parsing/82125 "2023-01-17T21:23:30Z")

</div>

There is a possible denial of service vulnerability in the Range header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44570. Versions Affected: \>= 1.5.0 Not affected: …

---

## [\[CVE-2022-30122\] Denial of Service Vulnerability in Rack Multipart Parsing](https://discuss.rubyonrails.org/t/cve-2022-30122-denial-of-service-vulnerability-in-rack-multipart-parsing/80729)

<div class="topic-metadata">

**Author:** [@tenderlove](https://discuss.rubyonrails.org/u/tenderlove)\
**Replies:** 0\
**Last updated:** [May 27, 2022, 4:03pm UTC](https://discuss.rubyonrails.org/t/cve-2022-30122-denial-of-service-vulnerability-in-rack-multipart-parsing/80729 "2022-05-27T16:03:58Z")

</div>

There is a possible denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30122. Versions Affected: \>= 1.2 Not affected: \< 1.2 F…

---

## [\[CVE-2022-30123\] Possible shell escape sequence injection vulnerability in Rack](https://discuss.rubyonrails.org/t/cve-2022-30123-possible-shell-escape-sequence-injection-vulnerability-in-rack/80728)

<div class="topic-metadata">

**Author:** [@tenderlove](https://discuss.rubyonrails.org/u/tenderlove)\
**Replies:** 0\
**Last updated:** [May 27, 2022, 4:02pm UTC](https://discuss.rubyonrails.org/t/cve-2022-30123-possible-shell-escape-sequence-injection-vulnerability-in-rack/80728 "2022-05-27T16:02:30Z")

</div>

There is a possible shell escape sequence injection vulnerability in the Lint and CommonLogger components of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-30123. Versions Affected: All. Not af…

---

## [Get subdomain(s) in Rack middleware](https://discuss.rubyonrails.org/t/get-subdomain-s-in-rack-middleware/75408)

<div class="topic-metadata">

**Author:** [@veganstraightedge](https://discuss.rubyonrails.org/u/veganstraightedge)\
**Replies:** 3\
**Last updated:** [May 26, 2020, 3:30pm UTC](https://discuss.rubyonrails.org/t/get-subdomain-s-in-rack-middleware/75408 "2020-05-26T15:30:19Z")

</div>

I have found myself needing to know what, if any, the subdomain is in a request… from within a Rack middleware. I’d like to redirect, change the path, or set the Current.locale based on that subdomain. To my surprise ev…