CVE-2011-5036: Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters with...

Security readout for executives and security teams

This issue lets a remote requester make older Rack versions spend excessive CPU processing many form parameters. For a business, the main risk is service outage or degraded web application availability, not data theft. The provided sources do not show active exploitation or a CVSS score. Exposure is most likely in Rack-based web applications that accept untrusted form submissions or request parameters and still run the affected Rack version ranges. The bundle’s structured affected-product data is incomplete, so validate from dependency inventories rather than CPE matching. Treat this as an availability risk for legacy Rack applications. It should be remediated during normal vulnerability maintenance, with faster action for public or high-traffic services still running affected versions. Mitigation focus: Upgrade Rack to 1.1.3, 1.2.5, 1.3.6, or later as applicable.; Use distribution guidance, such as Debian’s advisory, for packaged Rack deployments.; Prioritize internet-facing applications that parse form parameters from unauthenticated users..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.