There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5,
    `Rack::Directory`’s path check used a string prefix match on the expanded path. A request like
    `/../root_example/` can escape the configured root if the target path starts with the root string,
    allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.
    (CVE-2026-22860)

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4505 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-4505-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     March 23, 2026                              https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : ruby-rack     Version        : 2.1.4-3+deb11u5     CVE ID         : CVE-2026-22860 CVE-2026-25500     Debian Bug     : 1128479 1128480

    Two vulnerabilities were discovered in ruby-rack, a modular Ruby     webserver interface.

    CVE-2026-22860

        Rack::Directory's path check used a string prefix match on the         expanded path. A request like /../root_example/ could escape the         configured root if the target path started with the root string,         allowing directory listing outside the intended root.

    CVE-2026-25500

        Rack::Directory generated an HTML directory index where each file         entry was rendered as a clickable link. If a file existed on disk         whose basename started with the javascript: scheme, the generated         index contained an anchor whose href executed JavaScript in the         browser, resulting in a stored XSS vulnerability.

    For Debian 11 bullseye, these problems have been fixed in version     2.1.4-3+deb11u5.

    We recommend that you upgrade your ruby-rack packages.

    For the detailed security status of ruby-rack please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ruby-rack

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6180 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6180-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     March 26, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : ruby-rack     CVE ID         : CVE-2026-22860 CVE-2026-25500

    Two security issues (cross-site scripting and directory traversal) were     found in Rack, an interface for developing web applications in Ruby.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 2.2.22-0+deb12u1.

    For the stable distribution (trixie), these problems have been fixed in     version 3.1.20-0+deb13u1.

    We recommend that you upgrade your ruby-rack packages.

    For the detailed security status of ruby-rack please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ruby-rack

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the Rack Ruby library installed on the remote host is prior to 2.2.22, 3.x prior to 3.1.20, or 3.2.x prior to 3.2.5. It is, therefore, affected by multiple vulnerabilities:

  - Rack::Directory’s path check used a string prefix match on the expanded path. A request like     /../root_example/ can escape the configured root if the target path starts with the root string,     allowing directory listing outside the intended root. (CVE-2026-22860)

  - Rack::Directory generates an HTML directory index where each file entry is rendered as a clickable link.     If a file exists on disk whose basename begins with the javascript: scheme (e.g. javascript:alert(1)),     the generated index includes an anchor whose href attribute is exactly javascript:alert(1). Clicking     this entry executes arbitrary JavaScript in the context of the hosting application. (CVE-2026-25500)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5,     `Rack::Directory`'s path check used a string prefix match on the expanded path. A request like     `/../root_example/` can escape the configured root if the target path starts with the root string,     allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.
    (CVE-2026-22860)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8066-1 advisory.

    Minh Pham Quang discovered that Rack did not correctly handle parsing certain paths, which could lead to a     path traversal attack. An attacker could possibly use this issue to leak sensitive information.
    (CVE-2026-22860)

    Ali Firas discovered that Rack did not correctly sanitize certain inputs. An attacker could possibly use     this issue to execute arbitrary code. (CVE-2026-25500)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0318 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-34830:
    Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6,     Rack::Sendfile#map_accel_path interpolates the value of the X-Accel-Mapping request header directly into a     regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is not     escaped, an attacker who can supply X-Accel-Mapping to the backend can inject regex metacharacters and     control the generated X-Accel-Redirect response header. In deployments using Rack::Sendfile with x-accel-     redirect, this can allow an attacker to cause nginx to serve unintended files from configured internal     locations. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

    CVE-2026-34829:
    Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6,     Rack::Multipart::Parser only wraps the request body in a BoundedIO when CONTENT_LENGTH is present. When a     multipart/form-data request is sent without a Content-Length header, such as with HTTP chunked transfer     encoding, multipart parsing continues until end-of-stream with no total size limit. For file parts, the     uploaded body is written directly to a temporary file on disk rather than being constrained by the     buffered in-memory upload limit. An unauthenticated attacker can therefore stream an arbitrarily large     multipart file upload and consume unbounded disk space. This results in a denial of service condition for     Rack applications that accept multipart form data. This issue has been patched in versions 2.2.23, 3.1.21,     and 3.2.6.

    CVE-2026-34827:
    Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to     before 3.2.6, Rack::Multipart::Parser#handle_mime_head parses quoted multipart parameters such as Content-     Disposition: form-data; name=... using repeated String#index searches combined with String#slice! prefix     deletion. For escape-heavy quoted values, this causes super-linear processing. An unauthenticated attacker     can send a crafted multipart/form-data request containing many parts with long backslash-escaped parameter     values to trigger excessive CPU usage during multipart parsing. This results in a denial of service     condition in Rack applications that accept multipart form data. This issue has been patched in versions     3.1.21 and 3.2.6.

    CVE-2026-34826:
    Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6,     Rack::Utils.get_byte_ranges parses the HTTP Range header without limiting the number of individual byte     ranges. Although the existing fix for CVE-2024-26141 rejects ranges whose total byte coverage exceeds the     file size, it does not restrict the count of ranges. An attacker can supply many small overlapping ranges     such as 0-0,0-0,0-0,... to trigger disproportionate CPU, memory, I/O, and bandwidth consumption per     request. This results in a denial of service condition in Rack file-serving paths that process multipart     byte range responses. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

    CVE-2026-34786:
    Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6,     Rack::Static#applicable_rules evaluates several header_rules types against the raw URL-encoded PATH_INFO,     while the underlying file-serving path is decoded before the file is served. As a result, a request for a     URL-encoded variant of a static path can serve the same file without the headers that header_rules were     intended to apply. In deployments that rely on Rack::Static to attach security-relevant response headers     to static content, this can allow an attacker to bypass those headers by requesting an encoded form of the     path. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

    CVE-2026-34763:
    Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Directory     interpolates the configured root path directly into a regular expression when deriving the displayed     directory path. If root contains regex metacharacters such as +, *, or ., the prefix stripping can fail     and the generated directory listing may expose the full filesystem path in the HTML output. This issue has     been patched in versions 2.2.23, 3.1.21, and 3.2.6.

    CVE-2026-34230:
    Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6,     Rack::Utils.select_best_encoding processes Accept-Encoding values with quadratic time complexity when the     header contains many wildcard (*) entries. Because this method is used by Rack::Deflater to choose a     response encoding, an unauthenticated attacker can send a single request with a crafted Accept-Encoding     header and cause disproportionate CPU consumption on the compression middleware path. This results in a     denial of service condition for applications using Rack::Deflater. This issue has been patched in versions     2.2.23, 3.1.21, and 3.2.6.

    CVE-2026-26961:
    Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6,     Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular     expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one     rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first     boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream     inspection and have Rack parse a different body structure than the intermediary validated. This issue has     been patched in versions 2.2.23, 3.1.21, and 3.2.6.

    CVE-2026-25500:
    Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5,     `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link.
    If a file exists on disk whose basename starts with the `javascript:` scheme (e.g. `javascript:alert(1)`),     the generated index contains an anchor whose `href` is exactly `javascript:alert(1)`. Clicking the entry     executes JavaScript in the browser (demonstrated with `alert(1)`). Versions 2.2.22, 3.1.20, and 3.2.5 fix     the issue.

    CVE-2026-22860:
    Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5,     `Rack::Directory`s path check used a string prefix match on the expanded path. A request like     `/../root_example/` can escape the configured root if the target path starts with the root string,     allowing directory listing outside the intended root. Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
437749	SCA: security update for rack (GHSA-mxw3-3hh2-x2mh)	Tenable Self-Hosted Container Security	SCA Checks	2/17/2026	7/2/2026	high
437749	SCA: security update for rack (GHSA-mxw3-3hh2-x2mh)	Tenable Cloud Security	SCA Checks	2/17/2026	7/2/2026	high
303309	Debian dla-4505 : ruby-rack - security update	Nessus	Debian Local Security Checks	3/22/2026	3/22/2026	high
303893	Debian dsa-6180 : ruby-rack - security update	Nessus	Debian Local Security Checks	3/26/2026	3/26/2026	high
299587	Ruby Rack < 2.2.22 / 3.0.0.beta1 < 3.1.20 / 3.2.0 < 3.2.5 Multiple Vulnerabilities	Nessus	Misc.	2/19/2026	4/30/2026	high
299489	Linux Distros Unpatched Vulnerability : CVE-2026-22860	Nessus	Misc.	2/19/2026	7/30/2026	high
300486	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : Rack vulnerabilities (USN-8066-1)	Nessus	Ubuntu Local Security Checks	3/4/2026	3/4/2026	high
318553	TencentOS Server 4: pcs (TSSA-2026:0318)	Nessus	Tencent Local Security Checks	6/3/2026	6/3/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high