DEBIAN-CVE-2026-34763
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Directory interpolates the configured root path directly into a regular expression when deriving the displayed directory path. If root contains regex metacharacters such as +, *, or ., the prefix stripping can fail and the generated directory listing may expose the full filesystem path in the HTML output. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
DEBIAN-CVE-2026-34763
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-34763
ruby-rack
Source reference: /affected/0/package/name
- Affected versions
- 2.2.13-1~deb12u1
Source reference:
/affected/0/versions2.2.20-0+deb12u1Source reference:
/affected/0/versions2.2.22-0+deb12u1Source reference:
/affected/0/versions2.2.6.4-1Source reference:
/affected/0/versions2.2.6.4-1+deb12u1Source reference:
/affected/0/versions2.2.7-1Source reference:
/affected/0/versions2.2.7-1.1Source reference:
/affected/0/versions - Fixed versions
- 2.2.22-0+deb12u2
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
ruby-rack
Source reference: /affected/1/package/name
- Affected versions
- 3.1.16-0.1
Source reference:
/affected/1/versions3.1.18-1Source reference:
/affected/1/versions3.1.18-1~deb13u1Source reference:
/affected/1/versions3.1.20-0+deb13u1Source reference:
/affected/1/versions - Fixed versions
- 3.1.20-0+deb13u2
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
ruby-rack
Source reference: /affected/2/package/name
- Affected versions
- 3.1.16-0.1
Source reference:
/affected/2/versions3.1.18-1Source reference:
/affected/2/versions3.1.18-1~deb13u1Source reference:
/affected/2/versions3.2.4-1Source reference:
/affected/2/versions3.2.5-1Source reference:
/affected/2/versions3.2.5-2Source reference:
/affected/2/versions3.2.6-1Source reference:
/affected/2/versions - Fixed versions
- 3.2.6-2
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.22-0+deb12u2"
}
]
}
],
"package": {
"name": "ruby-rack",
"purl": "pkg:deb/debian/ruby-rack?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"2.2.13-1~deb12u1",
"2.2.20-0+deb12u1",
"2.2.22-0+deb12u1",
"2.2.6.4-1",
"2.2.6.4-1+deb12u1",
"2.2.7-1",
"2.2.7-1.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34763.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.20-0+deb13u2"
}
]
}
],
"package": {
"name": "ruby-rack",
"purl": "pkg:deb/debian/ruby-rack?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"3.1.16-0.1",
"3.1.18-1",
"3.1.18-1~deb13u1",
"3.1.20-0+deb13u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34763.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.6-2"
}
]
}
],
"package": {
"name": "ruby-rack",
"purl": "pkg:deb/debian/ruby-rack?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.1.16-0.1",
"3.1.18-1",
"3.1.18-1~deb13u1",
"3.2.4-1",
"3.2.5-1",
"3.2.5-2",
"3.2.6-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-34763.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #56819 · Revision 1
- Added to Heist Feed
- Publisher date