Summary
Andrew Lacambra discovered that Rack did not properly parse certain regular
expressions. An attacker could possibly use this issue to bypass network
security filters. (CVE-2026-26961)
William T. Nelson discovered that Rack did not handle multipart headers
correctly. An attacker could possibly use this issue to cause downstream
parsing issues or a denial of service. (CVE-2026-26962)
It was discovered that Rack did not handle the Forwarded header correctly.
An attacker could possibly use this issue to manipulate header values.
(CVE-2026-32762)
It was discovered that Rack could consume excessive CPU when handling
certain Accept-Encoding values. An attacker could possibly use this issue
to cause a denial of service. (CVE-2026-34230)
Haruki Oyama discovered that certain configurations of Rack could
erroneously fail to derive the displayed directory path, and expose the
full file system path. An attacker could possibly use this issue to
disclose deployment details such as layout and usernames. (CVE-2026-34763)
It was discovered that Rack did not properly handle static file paths. An
attacker could possibly use this issue to exfiltrate unintentionally served
data. (CVE-2026-34785)
Haruki Oyama discovered that Rack did not apply header rules to certain
requests for URL-encoded static paths. An attacker could possibly use this
issue to bypass security-relevant response headers. (CVE-2026-34786)
It was discovered that Rack did not limit the number of ranges requested in
the Range header. An attacker could possibly use this issue to cause a
denial of service. (CVE-2026-34826)
It was discovered that Rack could consume excessive CPU when parsing
certain multipart parameters. An attacker could possibly use this issue to
cause a denial of service. (CVE-2026-34827)
It was discovered that Rack could consume unbounded disk space when
handling requests without a Content-Length header. An attacker could
possibly use this issue to cause a denial of service. (CVE-2026-34829)
Mehtab Zafar discovered that Rack directly interpreted the X-Accel-Mapping
header as a regular expression without escaping. An attacker could possibly
use this issue to exfiltrate arbitrary files from internal locations.
(CVE-2026-34830)
It was discovered that Rack did not properly handle messages with Unicode.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2026-34831)
It was discovered that Rack did not properly parse the Host header. An
attacker could possibly use this issue to bypass security filters or poison
generated links. (CVE-2026-34835)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 26.04 LTS 26.04:LTS | ruby-rack | 3.2.4-1ubuntu1.1 |
Vulnerabilities 13
-
High 7.5
Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as "/css", it matc…
-
High 7.5
Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser
Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Multipart::Parser#handle_mime_head parses quoted multipart parameters such as Content-Disposition: form-data; name="..." using repeated S…
-
High 7.5
Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a BoundedIO when CONTENT_LENGTH is present. When a multipart/form-data request is sent without a Content-Length he…
-
Medium 5.9
Rack: Rack::Sendfile regex injection via HTTP_X_ACCEL_MAPPING header allows arbitrary file reads through nginx
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redir…
-
Medium 5.3
Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.select_best_encoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard (*) entries. Because this method …
-
Medium 5.3
Rack: Rack::Directory info disclosure and DoS via unescaped regex interpolation
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Directory interpolates the configured root path directly into a regular expression when deriving the displayed directory path. If root contains regex metacharacter…
-
Medium 5.3
Rack: Rack::Static header_rules bypass via URL-encoded paths
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static#applicable_rules evaluates several header_rules types against the raw URL-encoded PATH_INFO, while the underlying file-serving path is decoded before the fi…
-
Medium 5.3
Rack: Unbounded Range Count in get_byte_ranges Enables DoS
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.get_byte_ranges parses the HTTP Range header without limiting the number of individual byte ranges. Although the existing fix for CVE-2024-26141 rejects rang…
-
Medium 4.8
Rack: Header injection in multipart requests
Rack is a modular Ruby web server interface. From version 3.2.0 to before version 3.2.6, Rack::Multipart::Parser unfolds folded multipart part headers incorrectly. When a multipart header contains an obs-fold sequence, Rack preserves the embedded CRLF in pars…
-
Medium 4.8
Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing
Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21 and 3.2.0 to before 3.2.6, Rack::Utils.forwarded_values parses the RFC 7239 Forwarded header by splitting on semicolons before handling quoted-string values. Because quote…
-
Medium 4.8
Rack: Content-Length mismatch in Rack::Files error responses
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Files#fail sets the Content-Length response header using String#size instead of String#bytesize. When the response body contains multibyte UTF-8 characters, the de…
-
Medium 4.8CVE-2026-34835 Public exploit
Rack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass.
Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host header using an AUTHORITY regular expression that accepts characters not permitted in RFC-compliant hostnames, in…
-
Low 3.7
Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypass
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary…
References
-
report
https://ubuntu.com/security/CVE-2026-26961
-
report
https://ubuntu.com/security/CVE-2026-26962
-
report
https://ubuntu.com/security/CVE-2026-32762
-
report
https://ubuntu.com/security/CVE-2026-34230
-
report
https://ubuntu.com/security/CVE-2026-34763
-
report
https://ubuntu.com/security/CVE-2026-34785
-
report
https://ubuntu.com/security/CVE-2026-34786
-
report
https://ubuntu.com/security/CVE-2026-34826
-
report
https://ubuntu.com/security/CVE-2026-34827
-
report
https://ubuntu.com/security/CVE-2026-34829
-
report
https://ubuntu.com/security/CVE-2026-34830
-
report
https://ubuntu.com/security/CVE-2026-34831
-
report
https://ubuntu.com/security/CVE-2026-34835