🚨 [security] [ruby] Update faraday 2.13.4 → 2.14.2 (minor) - #320
Closed
depfu[bot] wants to merge 1 commit into
Closed
🚨 [security] [ruby] Update faraday 2.13.4 → 2.14.2 (minor)#320depfu[bot] wants to merge 1 commit into
depfu[bot] wants to merge 1 commit into
Cirrus CI / bundle-audit
failed
May 18, 2026 in 34s
Task Summary
Instruction audit failed in 00:01
Details
✅ 00:00 clone
✅ 00:06 os_setup
✅ 00:01 rbenv_setup
✅ 00:08 rbenv
✅ 00:01 bundle
✅ 00:12 install
❌ 00:01 audit
Name: rack
Version: 3.2.2
CVE: CVE-2026-34827
GHSA: GHSA-v6x5-cg8r-vv6x
Criticality: High
URL: https://github.com/rack/rack/security/advisories/GHSA-v6x5-cg8r-vv6x
Title: Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters
Solution: update to '~> 3.1.21', '>= 3.2.6'
Name: rack
Version: 3.2.2
CVE: CVE-2026-34829
GHSA: GHSA-8vqr-qjwx-82mw
Criticality: High
URL: https://github.com/rack/rack/security/advisories/GHSA-8vqr-qjwx-82mw
Title: Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads
Solution: update to '~> 2.2.23', '~> 3.1.21', '>= 3.2.6'
Name: rack
Version: 3.2.2
CVE: CVE-2026-34830
GHSA: GHSA-qv7j-4883-hwh7
Criticality: Medium
URL: https://github.com/rack/rack/security/advisories/GHSA-qv7j-4883-hwh7
Title: Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect
Solution: update to '~> 2.2.23', '~> 3.1.21', '>= 3.2.6'
Name: rack
Version: 3.2.2
CVE: CVE-2026-34831
GHSA: GHSA-q2ww-5357-x388
Criticality: Medium
URL: https://github.com/rack/rack/security/advisories/GHSA-q2ww-5357-x388
Title: Rack has Content-Length mismatch in Rack::Files error responses
Solution: update to '~> 2.2.23', '~> 3.1.21', '>= 3.2.6'
Name: rack
Version: 3.2.2
CVE: CVE-2026-34835
GHSA: GHSA-g2pf-xv49-m2h5
Criticality: Medium
URL: https://github.com/rack/rack/security/advisories/GHSA-g2pf-xv49-m2h5
Title: Rack::Request accepts invalid Host characters, enabling host allowlist bypass
Solution: update to '~> 3.1.21', '>= 3.2.6'
Name: rack-session
Version: 2.1.1
CVE: CVE-2026-39324
GHSA: GHSA-33qg-7wpp-89cq
Criticality: Unknown
URL: https://github.com/rack/rack-session/security/advisories/GHSA-33qg-7wpp-89cq
Title: Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization
Solution: update to '>= 2.1.2'
Vulnerabilities found!
Loading