asxpi/asxpio
asxpi/asxpio
1
0
Fork 0
Code Issues Pull requests Packages 1 Activity Actions

deps: update rack to 3.2.8
All checks were successful
Build and Deploy to Production / test (push) Successful in 45s
Details
Build and Deploy to Production / build (push) Successful in 1m6s
Details
Build and Deploy to Production / deploy (push) Successful in 40s
Details

Browse source 
rack 3.2.6 has a denial of service in the multipart parser
(CVE-2026-125111, GHSA-5v64-555j-wjxm): parsed data stays in the scan
buffer, so a crafted upload makes memory grow without bound. The app
is reachable from the internet and accepts multipart forms.

Only the lock changes; the Gemfile already allows ~> 3.2.

Assisted-by: Claude:fable-5-2
This commit is contained in:
Sergei Poljanski 2026-11-12 06:07:54 +04:00
commit db8a9e207d
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Gemfile.lock
View file

@ -80,7 +80,7 @@ GEM
prawn (>= 1.3.0, < 3.0.0) prawn (>= 1.3.0, < 3.0.0)
puma (6.6.1) puma (6.6.1)
nio4r (~> 2.0) nio4r (~> 2.0)
rack (3.2.6) rack (3.2.8)
rack-protection (4.2.1) rack-protection (4.2.1)
base64 (>= 0.1.0) base64 (>= 0.1.0)
logger (>= 1.6.0) logger (>= 1.6.0)