Sourced from rack's releases.

v3.2.6

Full Changelog: rack/rack@v3.2.5...v3.2.6

v3.2.4

No release notes provided.

v3.0.9.1

What's Changed

• Fixed ReDoS in Accept header parsing [CVE-2024-26146]
• Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
• Reject Range headers which are too large [CVE-2024-26141]

Full Changelog: rack/rack@v3.0.9...v3.0.9.1

v3.0.9

What's Changed

• Fix content-length calcuation in Rack:Response#write #2150

Full Changelog: rack/rack@v3.0.8...v3.0.9

v3.0.8

What's Changed

• Backport "Fix some unused variable verbose warnings" by @​skipkayhil in rack/rack#2084

New Contributors

• @​skipkayhil made their first contribution in rack/rack#2084

Full Changelog: rack/rack@v3.0.7...v3.0.8

v3.0.7

What's Changed

• Backport "Make query parameters without = have nil values". by @​jeremyevans in rack/rack#2060

Full Changelog: rack/rack@v3.0.6.1...v3.0.7

v3.0.6.1

No release notes provided.

v3.0.4.1

Full Changelog: rack/rack@v3.0.4...v3.0.4.1

v3.0.4

Full Changelog: rack/rack@v3.0.3...v3.0.4

v3.0.3

What's Changed

• Release v3.0.3 by @​ioquatix in rack/rack#2000

... (truncated)

Sourced from rack's changelog.

[3.2.6] - 2026-04-01

Security

• CVE-2026-34763 Root directory disclosure via unescaped regex interpolation in Rack::Directory.
• CVE-2026-34230 Avoid O(n^2) algorithm in Rack::Utils.select_best_encoding which could lead to denial of service.
• CVE-2026-32762 Forwarded header semicolon injection enables Host and Scheme spoofing.
• CVE-2026-26961 Raise error for multipart requests with multiple boundary parameters.
• CVE-2026-34786 Rack::Static header_rules bypass via URL-encoded path mismatch.
• CVE-2026-34831 Content-Length mismatch in Rack::Files error responses.
• CVE-2026-34826 Multipart byte range processing allows denial of service via excessive overlapping ranges.
• CVE-2026-34835 Rack::Request accepts invalid Host characters, enabling host allowlist bypass.
• CVE-2026-34830 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect.
• CVE-2026-34785 Rack::Static prefix matching can expose unintended files under the static root.
• CVE-2026-34829 Multipart parsing without Content-Length header allows unbounded chunked file uploads.
• CVE-2026-34827 Multipart header parsing allows denial of service via escape-heavy quoted parameters.
• CVE-2026-26962 Improper unfolding of folded multipart headers preserves CRLF in parsed parameter values.

[3.2.5] - 2026-02-16

Security

• CVE-2026-25500 XSS injection via malicious filename in Rack::Directory.
• CVE-2026-22860 Directory traversal via root prefix bypass in Rack::Directory.

Fixed

• Fix Rack::MockResponse#body when the body is a Proc. (#2420, #2423, @​tavianator, [@​ioquatix])

[3.2.4] - 2025-11-03

Fixed

• Multipart parser: limit MIME header size check to the unread buffer region to avoid false multipart mime part header too large errors when previously read data accumulates in the scan buffer. (#2392, @​alpaca-tc, @​willnet, @​krororo)

[3.2.3] - 2025-10-10

Security

• CVE-2025-61780 Improper handling of headers in Rack::Sendfile may allow proxy bypass.
• CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.

[3.2.2] - 2025-10-07

Security

• CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
• CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
• CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)

... (truncated)

• e1f22fd Bump patch version.
• 31989fd Fix typo in test.
• d268165 Fix test expectation.
• 8f425de Add Ruby v4.0 to the test matrix.
• bf83042 Drop EOL Rubies from external tests.
• d50c4d3 Implement OBS unfolding for multipart requests per RFC 5322 2.2.3
• bfb6914 Limit the number of quoted escapes during multipart parsing
• b3e5945 Add Content-Length size check in Rack::Multipart::Parser
• 7a8f326 Fix root prefix bug in Rack::Static
• a57bc14 Only do a simple substitution on the x-accel-mapping paths
• Additional commits viewable in compare view

Sourced from rack-session's releases.

v2.1.2

• CVE-2026-39324 Don't fall back to unencrypted coder if encryptors are present.

v2.1.1

Full Changelog: rack/rack-session@v2.1.0...v2.1.1

v2.1.0

Full Changelog: rack/rack-session@v2.0.0...v2.1.0

v2.0.0

What's Changed

• Revert "Rack < v3 compatible release." by @​ioquatix in rack/rack-session#20
• Set minimum rack version to 3.0.0+. by @​ioquatix in rack/rack-session#21

Full Changelog: rack/rack-session@v1.0.0...v2.0.0

Sourced from rack-session's changelog.

v2.1.2

• CVE-2026-39324 Don't fall back to unencrypted coder if encryptors are present.

v2.1.1

• Prevent Rack::Session::Pool from recreating deleted sessions CVE-2025-46336.

v2.1.0

• Improved compatibility with Ruby 3.3+ and Rack 3+.
• Add support for cookie option partitioned.
• Introduce assume_ssl option to allow secure session cookies through insecure proxy.

v2.0.0

• Initial migration of code from Rack 2, for Rack 3 release.

• 504367b Bump patch version.
• f43638c Don't fall back to unencrypted coder if encryptors are present.
• dadcfe6 Bump actions/checkout from 4 to 5 (#54)
• 4eb9ea8 Add top level session spec to validate existing formats.
• 8f94577 Add rails to external tests.
• 38ea47d Allow the v2 encryptor to serialize messages with Marshal (#44)
• 43f2e3a Fix compatibility with older Rubies.
• 6a060b8 Support UTF-8 data when using the JSON serializer (#39)
• 8ce0146 Fix auth_tag retrieval on JRuby (#32)
• 7727185 Add AEAD encryption (#23)
• Additional commits viewable in compare view

Sourced from rackup's changelog.

Releases

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

v2.2.1

• Try to require webrick and rackup/handler/webrick by default, for compatibility with code that expects them to be available.

v2.2.0

• Remove old rack shims.
• Remove webrick dependency.

v2.1.0

• Correctly support streaming responses with webrick.

v2.0.0

• Initial release and migration of code from rack.

• f3fa1d6 Bump patch version.
• 583c7dc Fix WEBrick SERVER_PORT handling.
• adc9596 Bump minor version.
• 8e538be Update the webrick handler to support OPTIONS * requests. (#40)
• 7a3e190 Update workflows.
• 5d18f5a Update spec_server.rb
• c6cdd47 Fix references from Rack::Server to Rackup::Server in comments
• e3df7cb Provide a 'Changelog' link on rubygems.org/gems/rackup
• 39d5226 Documentation for how to access handlers programatically.
• 301b6dd Update releases.md - fixes #29.
• Additional commits viewable in compare view