rack

Security advisories4

• rack: Rack::Request#host_with_port and `#base_url` return an invalid `Host` verbatim, enabling URL and allowlist bypassfixed in 3.1.23, 3.2.8
• rack: Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.fixed in 2.2.25, 3.1.23, 3.2.8
• rack: Multipart boundary guard skips a leading empty or quoted `boundary` parameter, allowing parser differentials and WAF bypassfixed in 2.2.25, 3.1.23, 3.2.8
• rack: Rack::Static `header_rules` bypass via unnormalized dot segments in the request pathfixed in 2.2.25, 3.1.23, 3.2.8

Versions that change something