Back Linuxsecurity

Ubuntu 25.10 Rack Advisory USN-8182

Linuxsecurity •LinuxSecurity Advisories • April 17, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in Rack. Software Description: - ruby-rack: modular Ruby webserver interface Details: Andrew Lacambra discovered that Rack did not properly parse certain regular expressions. An attacker could possibly use this issue to bypass network security filters. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2026-26961) William T. Nelson discovered that Rack did not handle multipart headers correctly. An attacker could possibly use this issue to cause downstream parsing issues or a denial of service. This issue only affected Ubuntu 25.10. (CVE-2026-26962) It was discovered that Rack did not handle the Forwarded header correctly.

The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 ruby-rack 3.1.16-0.1ubuntu0.3 Ubuntu 24.04 LTS ruby-rack 2.2.7-1ubuntu0.7 Ubuntu 22.04 LTS ruby-rack 2.1.4-5ubuntu1.2+esm3 Available with Ubuntu Pro Ubuntu 20.04 LTS ruby-rack 2.0.7-2ubuntu0.1+esm10 Available with Ubuntu Pro Ubuntu 18.04 LTS ruby-rack 1.6.4-4ubuntu0.2+esm10 Available with Ubuntu Pro Ubuntu 16.04 LTS ruby-rack 1.6.4-3ubuntu0.2+esm10 Available with Ubuntu Pro Ubuntu 14.04 LTS librack-ruby 1.5.2-3+deb8u3ubuntu1~esm11 Available with Ubuntu Pro librack-ruby1.8 1.5.2-3+deb8u3ubuntu1~esm11 Available with Ubuntu Pro librack-ruby1.9.1 1.5.2-3+deb8u3ubuntu1~esm11 Available with Ubuntu Pro ruby-rack 1.5.2-3+deb8u3ubuntu1~esm11 Available with Ubuntu Pro After a standard system update you need to restart any applications using Rack to make all the necessary changes.

CVE-2026-26961, CVE-2026-26962, CVE-2026-32762, CVE-2026-34230, CVE-2026-34763, CVE-2026-34785, CVE-2026-34786, CVE-2026-34826, CVE-2026-34827, CVE-2026-34829, CVE-2026-34830, CVE-2026-34831, CVE-2026-34835

CVE-2026-26961, CVE-2026-26962, CVE-2026-32762, CVE-2026-34230,

CVE-2026-34763, CVE-2026-34785, CVE-2026-34786, CVE-2026-34826,

CVE-2026-34827, CVE-2026-34829, CVE-2026-34830, CVE-2026-34831,

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Discovered in Rack Affecting Ubuntu Releases On April 17, 2026, multiple vulnerabilities in the Rack web server interface were disclosed, affecting several versions of Ubuntu, including 20.04 LTS, 22.04 LTS, 24.04 LTS, and 25.10. The vulnerabilities include improper parsing of regular expressions (CVE-2026-26961), mishandling of multipart headers (CVE-2026-26962), and incorrect handling of the Forwarded header (CVE-2026-32762). These issues could allow attackers to bypass network security filters, cause denial of service, or manipulate header values. Other vulnerabilities could lead to excessive CPU consumption and potential information disclosure. The affected versions span from Ubuntu 14.04 LTS to 25.10, indicating a broad impact across multiple releases. Users are advised to update their systems to the latest package versions to mitigate these vulnerabilities. The vulnerabilities were published on April 2, 2026, and are now being actively addressed by the community. 2 sources 58

Extracted Entities

Ubuntu 25.10 Rack Advisory USN-8182

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (13)

Platforms (3)