{"action":"Upgrade rack to 2.1.4 or later.","affected":[{"fixed":"2.1.4","introduced":"0"},{"fixed":"2.2.3","introduced":"2.2.0"}],"component":"rack","cve_ids":["CVE-2020-8184"],"ecosystem":"RubyGems","epss":0.02938,"exploited":false,"fixed_versions":["2.1.4","2.2.3"],"ghsa_id":"GHSA-j6w9-fv6q-3q52","id":"tcs_01M5KEKT43N5THKD7CKAKC82FC","modified_at":"2026-09-10T03:49:25.325945900Z","published_at":"2020-06-24T17:15:00Z","references":["https://osv.dev/vulnerability/GHSA-j6w9-fv6q-3q52","https://nvd.nist.gov/vuln/detail/CVE-2020-8184","https://github.com/rack/rack/commit/1f5763de6a9fe515ff84992b343d63c88104654c","https://hackerone.com/reports/895727","https://github.com/rack/rack","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2020-8184.yml","https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak","https://lists.debian.org/debian-lts-announce/2020/07/msg00006.html","https://lists.debian.org/debian-lts-announce/2023/01/msg00038.html","https://usn.ubuntu.com/4561-1"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-j6w9-fv6q-3q52","url":"https://osv.dev/vulnerability/GHSA-j6w9-fv6q-3q52"}],"summary":"Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names"}