Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 521
Alerts This Week
Warning Icon 1 521

Stay Secure with the Latest Linux Advisories

Opensuse Large Esm H800
openSUSE

openSUSE go1.25-openssl Important Security Issues 2026-3151-1

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE aws-nitro-enclaves-cli Important Issues Advisory 2026-3152-1

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE nghttp2 Moderate HTTP Request Smuggling Issue 2026-3153-1

Calendar White Jul 21, 2026
moderate
Opensuse Large Esm H800
openSUSE

openSUSE python-tornado6 Moderate Credential Leak Vulnerability 2026-3155-1

Calendar White Jul 21, 2026
moderate
Opensuse Large Esm H900
openSUSE

openSUSE Kernel Important Security Update Vulnerability Fix 2026-3156-1

Calendar White Jul 21, 2026
Important
Opensuse Large Esm H900
openSUSE

openSUSE php7 Moderate Buffer Vulnerability Resolution SUSE-SU-2026-3165-1

Calendar White Jul 21, 2026
moderate
Rockylinux Esm H800
Rocky

Rocky Linux httpd Important Denial of Service Fix RLSA-2026-42828

Calendar White Jul 21, 2026
Important
Ubuntu Large Esm H900
Ubuntu

Ubuntu Imagemagick Critical Denial of Service Vulnerabilities USN-8558-1

Calendar White Jul 21, 2026
Critical
Ubuntu Large Esm H900
Ubuntu

Ubuntu jbig2dec Important Denial of Service Vulnerabilities USN-8582-1

Calendar White Jul 21, 2026
Important
Filter%20icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found 7 articles for you...
203
Ls Advisories Mageia Esm H240
Price Tag%201security advisorydenial of servicemultiple threats

Mageia 9 ruby-rack Critical Multiple Threats Security Update 2026-0226

Security update. Publication date: 18 Jun 2026 URL: https://advisories.mageia.org/MGASA-2026-0226.html Type: security Affected Mageia releases: 9 CVE: CVE-2026-26961, CVE-2026-32762, CVE-2026-34230, CVE-2026-34763, CVE-2026-34785, CVE-2026-34786, CVE-2026-34826, CVE-2026-34827, CVE-2026-34829, CVE-2026-34830, CVE-2026-34831, CVE-2026-34835 Description: CVE-2026-26961 Greedy multipart boundary parsing can cause parser differentials and WAF bypass. `Forwarded` header semicolon injection enables `Host` and `Scheme` spoofing. CVE-2026-34230 Quadratic complexity in `Rack::Utils.select_best_encoding` via wildcard `Accept-Encoding` header. CVE-2026-34763 Root directory disclosure via unescaped regex interpolation in `Rack::Directory`. CVE-2026-34785 `Rack::Static` prefix matching can expose unintended files under the static root. CVE-2026-34786 `Rack::Static` `header_rules` bypass via URL-encoded path mismatch. CVE-2026-34826 Multipart byte range processing allows denial of service via excessive overlapping ranges. CVE-2026-34827 Multipart header parsing allows denial of service via escape-heavy quoted parameters. CVE-2026-34829 Multipart parsing without `Content-Length` header allows unbounded chunked file uploads. CVE-2026-34830 `Rack::Sendfile` header-based `X-Accel-Mapping` regex injection enables unauthorized `X-Accel-Redirect`. CVE-2026-34831 `Content-Length` mismatch in `Rack::Files` error responses. CVE-2026-34835 `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass. References: - https://bugs.mageia.org/show_bug.cgi?id=35446 - https://github.com/rack/rack/security/advisories/GHSA-vgpv-f759-9wx3 - https://github.com/rack/rack/security/advisories/GHSA-qfgr-crr9-7r49 - https://github.com/rack/rack/security/advisories/GHSA-v569-hp3g-36wr - https://github.com/rack/rack/security/advisories/GHSA-7mqq-6cf9-v2qp - https://github.com/rack/rack/security/advisories/GHSA-h2jq-g4cq-5ppq -https://github.com/rack/rack/security/advisories/GHSA-q4qf-9j86-f5mh - https://github.com/rack/rack/security/advisories/GHSA-x8cg-fq8g-mxfx - https://github.com/rack/rack/security/advisories/GHSA-v6x5-cg8r-vv6x - https://github.com/rack/rack/security/advisories/GHSA-8vqr-qjwx-82mw - https://github.com/rack/rack/security/advisories/GHSA-qv7j-4883-hwh7 - https://github.com/rack/rack/security/advisories/GHSA-q2ww-5357-x388 - https://github.com/rack/rack/security/advisories/GHSA-g2pf-xv49-m2h5 - https://www.cve.org/CVERecord?id=CVE-2026-26961 - https://www.cve.org/CVERecord?id=CVE-2026-32762 - https://www.cve.org/CVERecord?id=CVE-2026-34230 - https://www.cve.org/CVERecord?id=CVE-2026-34763 - https://www.cve.org/CVERecord?id=CVE-2026-34785 - https://www.cve.org/CVERecord?id=CVE-2026-34786 - https://www.cve.org/CVERecord?id=CVE-2026-34826 - https://www.cve.org/CVERecord?id=CVE-2026-34827 - https://www.cve.org/CVERecord?id=CVE-2026-34829 - https://www.cve.org/CVERecord?id=CVE-2026-34830 - https://www.cve.org/CVERecord?id=CVE-2026-34831 - https://www.cve.org/CVERecord?id=CVE-2026-34835 SRPMS: - 9/core/ruby-rack-2.2.23-1.mga9 . Critical updates addressing multiple security issues in ruby-rack for Mageia 9, including Denial of Service risks and parsing errors.. Mageia security advisory, ruby-rack update, Denial of Service, CVE-2026 updates. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Jun 18, 2026 •Critical Mageia
203
Ls Advisories Mageia Esm H240
Price Tag%201security advisorydirectory traversalimportant

Mageia 9 ruby-rack Important Directory Issues MGASA-2026-0075

MGASA-2026-0075 - Updated ruby-rack packages fix security vulnerabilities. MGASA-2026-0075 - Updated ruby-rack packages fix security vulnerabilities Publication date: 31 Mar 2026 URL: https://advisories.mageia.org/MGASA-2026-0075.html Type: security Affected Mageia releases: 9 CVE: CVE-2026-22860, CVE-2026-25500 Description: Rack has a Directory Traversal via Rack:Directory. (CVE-2026-22860) Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href. (CVE-2026-25500) References: - https://bugs.mageia.org/show_bug.cgi?id=35285 - https://lists.debian.org/debian-security-announce/2026/msg00089.html - https://www.cve.org/CVERecord?id=CVE-2026-22860 - https://www.cve.org/CVERecord?id=CVE-2026-25500 SRPMS: - 9/core/ruby-rack-2.2.22-1.mga9 . Updated ruby-rack packages for Mageia fix critical security flaws, including directory traversal and stored XSS issues.. Mageia Ruby Rack Security Patch 2026. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Apr 01, 2026 •Important Mageia
Banner 2 1028x280 1708121730 1 1771599631
87
Ls Advisories Debian Esm H240
Price Tag%201security advisorycriticaldebian

Debian 12 13 ruby-rack Critical XSS Directory Traversal DSA-6180-1

Two security issues (cross-site scripting and directory traversal) were found in Rack, an interface for developing web applications in Ruby. For the oldstable distribution (bookworm), these problems have been fixed in version 2.2.22-0+deb12u1. For the stable distribution (trixie), these problems have been fixed in. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6180-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Moritz Muehlenhoff March 26, 2026 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : ruby-rack CVE ID : CVE-2026-22860 CVE-2026-25500 Two security issues (cross-site scripting and directory traversal) were found in Rack, an interface for developing web applications in Ruby. For the oldstable distribution (bookworm), these problems have been fixed in version 2.2.22-0+deb12u1. For the stable distribution (trixie), these problems have been fixed in version 3.1.20-0+deb13u1. We recommend that you upgrade your ruby-rack packages. For the detailed security status of ruby-rack please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/ruby-rack Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Two critical security issues in ruby-rack affect Debian 12 and 13 distributions. Immediate upgrades are recommended for safety.. Ruby Rack, Debian Security, Cross Site Scripting, Directory Traversal, Security Updates. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Mar 26, 2026 •Critical Debian
197
Ls Advisories Deblts Esm H240
Price Tag%201security advisorycriticalXSS

Debian DLA-4505-1 ruby-rack Critical Directory Listing XSS

Two vulnerabilities were discovered in ruby-rack, a modular Ruby webserver interface. CVE-2026-22860 Rack::Directory's path check used a string prefix match on the expanded path. A request like /../root_example/ could escape the. Debian LTS Advisory DLA-4505-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Utkarsh Gupta March 23, 2026 https://wiki.debian.org/LTS Package : ruby-rack Version : 2.1.4-3+deb11u5 CVE ID : CVE-2026-22860 CVE-2026-25500 Debian Bug : 1128479 1128480 Two vulnerabilities were discovered in ruby-rack, a modular Ruby webserver interface. CVE-2026-22860 Rack::Directory's path check used a string prefix match on the expanded path. A request like /../root_example/ could escape the configured root if the target path started with the root string, allowing directory listing outside the intended root. CVE-2026-25500 Rack::Directory generated an HTML directory index where each file entry was rendered as a clickable link. If a file existed on disk whose basename started with the javascript: scheme, the generated index contained an anchor whose href executed JavaScript in the browser, resulting in a stored XSS vulnerability. For Debian 11 bullseye, these problems have been fixed in version 2.1.4-3+deb11u5. We recommend that you upgrade your ruby-rack packages. For the detailed security status of ruby-rack please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/ruby-rack Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Two vulnerabilities in ruby-rack could lead to directory listing and stored XSS attacks. Upgrade packages to mitigate risks.. ruby-rack vulnerability, Debian LTS advisory, XSS issue, directory listing risk. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Mar 23, 2026 •Critical Debian LTS
Banner 2 1028x280 1708121730 1 1771599631
172
Ls Advisories Ubuntu Esm H240
Price Tag%201security advisorycriticalUbuntu

Ubuntu 25.10 Rack Critical Path Traversal Code Execution Vulnerabilities

Several security issues were fixed in Rack.. ========================================================================== Ubuntu Security Notice USN-8066-1 February 26, 2026 ruby-rack vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: Several security issues were fixed in Rack. Software Description: - ruby-rack: modular Ruby webserver interface Details: Minh Pham Quang discovered that Rack did not correctly handle parsing certain paths, which could lead to a path traversal attack. An attacker could possibly use this issue to leak sensitive information. (CVE-2026-22860) Ali Firas discovered that Rack did not correctly sanitize certain inputs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-25500) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 ruby-rack 3.1.16-0.1ubuntu0.2 Ubuntu 24.04 LTS ruby-rack 2.2.7-1ubuntu0.6 Ubuntu 22.04 LTS ruby-rack 2.1.4-5ubuntu1.2+esm2 Available with Ubuntu Pro Ubuntu 20.04 LTS ruby-rack 2.0.7-2ubuntu0.1+esm9 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8066-1 CVE-2026-22860, CVE-2026-25500 Package Information: https://launchpad.net/ubuntu/+source/ruby-rack/3.1.16-0.1ubuntu0.2 https://launchpad.net/ubuntu/+source/ruby-rack/2.2.7-1ubuntu0.6 . Several Rack security fixes are available for Ubuntu 20.04 to 25.10. Critical updates recommended to mitigate risks.. ruby-rack security. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Feb 26, 2026 •Critical Ubuntu
172
Ls Advisories Ubuntu Esm H240
Price Tag%201security advisorydenial of serviceUbuntu

Ubuntu 25.10: Rack Critical DoS Risk Fix USN-7960-1 CVE-2025-59830

Several security issues were fixed in Rack.. ========================================================================== Ubuntu Security Notice USN-7960-1 January 14, 2026 ruby-rack vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in Rack. Software Description: - ruby-rack: modular Ruby webserver interface Details: It was discovered that Rack incorrectly handled certain query parameters. An attacker could possibly use this issue to cause a limited denial of service. This issue was only addressed in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2025-59830) It was discovered that Rack did not properly handle certain multipart form data. An attacker could possibly use this issue to cause memory exhaustion, leading to a denial of service. This issue was only addressed in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-61770, CVE-2025-61772) It was discovered that Rack did not properly handle certain form fields. An attacker could possibly use this issue to cause memory exhaustion, leading to a denial of service. This issue was only addressed in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-61771) It was discovered that Rack did not properly handle certain headers. An attacker could possibly use this issue to bypass proxy access restrictions and obtain sensitive information. (CVE-2025-61780) Tomoya Yamashita discovered that Rack did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause memory exhaustion, leading to a denial of service. This issue was only addressed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-61919) Update instructions: The problem can be corrected by updating your system to the following packageversions: Ubuntu 25.10 ruby-rack 3.1.16-0.1ubuntu0.1 Ubuntu 24.04 LTS ruby-rack 2.2.7-1ubuntu0.5 Ubuntu 22.04 LTS ruby-rack 2.1.4-5ubuntu1.2 Ubuntu 20.04 LTS ruby-rack 2.0.7-2ubuntu0.1+esm8 Available with Ubuntu Pro Ubuntu 18.04 LTS ruby-rack 1.6.4-4ubuntu0.2+esm9 Available with Ubuntu Pro Ubuntu 16.04 LTS ruby-rack 1.6.4-3ubuntu0.2+esm9 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7960-1 CVE-2025-59830, CVE-2025-61770, CVE-2025-61771, CVE-2025-61772, CVE-2025-61780, CVE-2025-61919 Package Information: https://launchpad.net/ubuntu/+source/ruby-rack/3.1.16-0.1ubuntu0.1 https://launchpad.net/ubuntu/+source/ruby-rack/2.2.7-1ubuntu0.5 https://launchpad.net/ubuntu/+source/ruby-rack/2.1.4-5ubuntu1.2 . Several security issues in Rack were fixed for multiple Ubuntu releases with potential denial of service and memory exhaustion risks.. rack vulnerabilities, ruby webserver, ubuntu security, denial of service, memory management. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Jan 15, 2026 •Important Ubuntu
Banner 2 1028x280 1708121730 1 1771599631
203
Ls Advisories Mageia Esm H240
Price Tag%201security advisoryDoSimportant

Mageia 9: ruby-rack Important DoS Threat Advisory MGASA-2025-0334

MGASA-2025-0334 - Updated ruby-rack packages fix security vulnerabilities. MGASA-2025-0334 - Updated ruby-rack packages fix security vulnerabilities Publication date: 29 Dec 2025 URL: https://advisories.mageia.org/MGASA-2025-0334.html Type: security Affected Mageia releases: 9 CVE: CVE-2025-46727, CVE-2025-49007, CVE-2025-59830, CVE-2025-61770, CVE-2025-61771, CVE-2025-61772, CVE-2025-61919, CVE-2025-61780 Description: Unbounded-Parameter DoS in Rack::QueryParser. (CVE-2025-46727) ReDoS Vulnerability in Rack::Multipart handle_mime_head. (CVE-2025-49007) Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters. (CVE-2025-59830) Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion). (CVE-2025-61770) Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion). (CVE-2025-61771) Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion). (CVE-2025-61772) Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing. (CVE-2025-61919) Rack has Possible Information Disclosure Vulnerability. (CVE-2025-61780) References: - https://bugs.mageia.org/show_bug.cgi?id=34755 - https://rack.github.io/rack/3.2/CHANGELOG_md.html - https://www.cve.org/CVERecord?id=CVE-2025-46727 - https://www.cve.org/CVERecord?id=CVE-2025-49007 - https://www.cve.org/CVERecord?id=CVE-2025-59830 - https://www.cve.org/CVERecord?id=CVE-2025-61770 - https://www.cve.org/CVERecord?id=CVE-2025-61771 - https://www.cve.org/CVERecord?id=CVE-2025-61772 - https://www.cve.org/CVERecord?id=CVE-2025-61919 - https://www.cve.org/CVERecord?id=CVE-2025-61780 SRPMS: - 9/core/ruby-rack-2.2.21-1.mga9 . Updated ruby-rack packages in Mageia address critical DoS threats and enhance application security.. ruby rack updates, Mageia security fix, DoS vulnerabilities, security patches, Ruby application safety. . Severity: Important. LinuxSecurity.com Team

Calendar%202 Dec 29, 2025 •Important Mageia
87
Ls Advisories Debian Esm H240
Price Tag%201security advisorydenial of servicedebian

Debian: ruby-rack Critical Denial of Service Vulnerabilities DSA-6048-1

Multiple security issues were found in Rack, an interface for developing web applications in Ruby, which could result in denial of service or proxy bypass. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-6048-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Moritz Muehlenhoff November 03, 2025 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : ruby-rack CVE ID : CVE-2025-61770 CVE-2025-61771 CVE-2025-61772 CVE-2025-61780 CVE-2025-61919 Multiple security issues were found in Rack, an interface for developing web applications in Ruby, which could result in denial of service or proxy bypass. For the oldstable distribution (bookworm), these problems have been fixed in version 2.2.20-0+deb12u1. For the stable distribution (trixie), these problems have been fixed in version 3.1.18-1~deb13u1. We recommend that you upgrade your ruby-rack packages. For the detailed security status of ruby-rack please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/ruby-rack Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Critical Ruby Rack security issues found, upgrade suggested for Debian distributions against denial of service threats.. ruby rack security, Debian advisory, software patch, security update. . Severity: Critical. LinuxSecurity.com Team

Calendar%202 Nov 03, 2025 •Critical Debian
Banner 2 1028x280 1708121730 1 1771599631
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

More Polls

Should Linux servers automatically install security updates?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/157-should-linux-servers-automatically-install-security-updates?task=poll.vote&format=json
157
radio
0
[{"id":506,"title":"Yes \u2014 critical security patches should install automatically.","votes":0,"type":"x","order":1,"pct":0,"resources":[]},{"id":507,"title":"No \u2014 every update should be tested before deployment.","votes":0,"type":"x","order":2,"pct":0,"resources":[]},{"id":508,"title":"Only critical vulnerabilities should auto-install.","votes":0,"type":"x","order":3,"pct":0,"resources":[]},{"id":509,"title":"I patch when Reddit starts panicking.","votes":1,"type":"x","order":4,"pct":100,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200

Search Topics