Red Hat CVE-2026-34786

Rack::Static is a Ruby web server middleware that serves static files and applies conditional response headers via header_rules configuration. The vulnerability stems from a path normalization inconsistency: the applicable_rules method evaluates header_rules conditions against the raw, URL-encoded PATH_INFO variable, but the actual file-serving logic decodes the path before lookup and file delivery. This divergence (CWE-180: Incorrect Calculation of Buffer Size) means that a request for a path like /static%2Fdoc.html will bypass header matching rules intended for /static/doc.html, since the comparison operates on encoded form while file resolution uses decoded form. Applications using Rack::Static as a security boundary for static assets are particularly vulnerable when relying on header rules to enforce caching policies, MIME-type validation, or access controls.