Skip to content
OpenAdvisories
Medium · 4.8 Public exploit CVE-2026-34835 EUVD-2026-18478GHSA-g2pf-xv49-m2h5

Rack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass.

Published Apr 2, 2026 · Updated Apr 2, 2026 · Assigned by GitHub_M

Vendor: rack Product: rack Package: kube-fluentd-operator Package: logstash-9.3 Package: logstash-9.3-iamguarded-compat Package: logstash-9.3-with-output-opensearch Package: rack Package: ruby-rack Package: ruby-rack Ecosystem: Debian Ecosystem: RubyGems Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host header using an AUTHORITY regular expression that accepts characters not permitted in RFC-compliant hostnames, including /, ?, #, and @. Because req.host returns the full parsed value, applications that validate hosts using naive prefix or suffix checks can be bypassed. This can lead to host header poisoning in applications that use req.host, req.url, or req.base_url for link generation, redirects, or origin validation. This issue has been patched in versions 3.1.21 and 3.2.6.

Affected products

VendorProductAffectedFixed
rack rack >= 3.0.0.beta1, < 3.1.21, >= 3.2.0, < 3.2.6 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 ruby-rack 3.2.6-2 —
Debian 13 ruby-rack 3.1.20-0+deb13u2 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS ruby-rack 3.2.4-1ubuntu1.1 USN-8989-1
Ubuntu 25.10 ruby-rack 3.1.16-0.1ubuntu0.3 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling kube-fluentd-operator 1.18.2-r60 —
Wolfi rolling logstash-9.3 +2 9.3.3-r2 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Cyber-note/CVE-2026-34835-Black-box-Analysis ★ 6 · Jul 3, 2026

    A black-box (DAST) security analysis of CVE-2026-34835 focusing on external validation methodology, observable behavior, security impact, and defensive recommendations.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems rack >= 3.0.0.beta1, < 3.1.21 3.1.21 GHSA-g2pf-xv49-m2h5
RubyGems rack >= 3.2.0, < 3.2.6 3.2.6 GHSA-g2pf-xv49-m2h5

Advisories 1

References