Skip to main content

Rack CVE-2026-34786

| EUVDEUVD-2026-18384 MEDIUM
Incorrect Behavior Order: Validate Before Canonicalize (CWE-180)
2026-04-02 security-advisories@github.com GHSA-q4qf-9j86-f5mh
Authentication Bypass Rack
5.3
CVSS 3.1 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

4
Patch released
Apr 03, 2026 - 02:30 nvd
Patch available
EUVD ID Assigned
Apr 02, 2026 - 17:22 euvd
EUVD-2026-18384
Analysis Generated
Apr 02, 2026 - 17:22 vuln.today
CVE Published
Apr 02, 2026 - 17:16 nvd
MEDIUM 5.3

DescriptionCVE.org

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static#applicable_rules evaluates several header_rules types against the raw URL-encoded PATH_INFO, while the underlying file-serving path is decoded before the file is served. As a result, a request for a URL-encoded variant of a static path can serve the same file without the headers that header_rules were intended to apply. In deployments that rely on Rack::Static to attach security-relevant response headers to static content, this can allow an attacker to bypass those headers by requesting an encoded form of the path. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

AnalysisAI

Rack::Static fails to apply security-relevant response headers to URL-encoded variants of static file paths, allowing attackers to bypass header-based security controls by requesting percent-encoded forms of protected resources. This affects Rack versions prior to 2.2.23, 3.1.21, and 3.2.6, and is particularly dangerous in deployments relying on Rack::Static to enforce Content-Security-Policy, X-Frame-Options, or similar protective headers on static content. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

Rack::Static is a Ruby web server middleware that serves static files and applies conditional response headers via header_rules configuration. The vulnerability stems from a path normalization inconsistency: the applicable_rules method evaluates header_rules conditions against the raw, URL-encoded PATH_INFO variable, but the actual file-serving logic decodes the path before lookup and file delivery. This divergence (CWE-180: Incorrect Calculation of Buffer Size) means that a request for a path like /static%2Fdoc.html will bypass header matching rules intended for /static/doc.html, since the comparison operates on encoded form while file resolution uses decoded form. Applications using Rack::Static as a security boundary for static assets are particularly vulnerable when relying on header rules to enforce caching policies, MIME-type validation, or access controls.

RemediationAI

Upgrade Rack immediately to version 2.2.23 or later (for 2.2.x series), 3.1.21 or later (for 3.1.x series), or 3.2.6 or later (for 3.2.x series), depending on which release series is in use. For Rails applications, running bundle update rack will apply the patch if Gemfile constraints permit; for other Rack-based applications, update Gemfile.lock or equivalent dependency file to reference the patched version and redeploy. As an interim workaround before patching, applications can validate or normalize PATH_INFO before passing to Rack::Static, or move security-critical header enforcement to the application layer or a reverse proxy (e.g., nginx, AWS CloudFront) that applies headers based on decoded URL path. Full remediation guidance is available in the GitHub Security Advisory at https://github.com/rack/rack/security/advisories/GHSA-q4qf-9j86-f5mh.

More in Rack

View all
CVE-2026-22860 HIGH POC
7.5 Feb 18

Directory traversal in Rack versions prior to 2.2.22, 3.1.20, and 3.2.5 allows unauthenticated remote attackers to list

CVE-2024-26141 HIGH POC
7.5 Feb 29

Rack is a modular Ruby web server interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable,
CVE-2024-25126 HIGH POC
7.5 Feb 29

Rack is a modular Ruby web server interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable,
CVE-2020-8184 HIGH POC
7.5 Jun 19

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 tha
CVE-2022-30123 CRITICAL
10.0 Dec 05

A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell

CVE-2025-25184 MEDIUM POC
5.7 Feb 12

Rack provides an interface for developing web applications in Ruby. Rated medium severity (CVSS 5.7), this vulnerability
CVE-2026-25500 MEDIUM POC
5.4 Feb 18

Rack's Directory module fails to sanitize filenames when generating HTML directory listings, allowing attackers to craft
CVE-2026-39324 CRITICAL
9.3 Apr 07

Session authentication bypass in Rack::Session::Cookie 2.0.0 through 2.1.1 allows unauthenticated remote attackers to fo
CVE-2020-8161 HIGH
8.6 Jul 02

A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerabi
CVE-2013-0263 MEDIUM
5.1 Feb 08

Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x
CVE-2025-46727 HIGH
7.5 May 07

Rack is a modular Ruby web server interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable,
CVE-2015-3225 MEDIUM
5.0 Jul 26

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products

Same weakness CWE-180 – Incorrect Behavior Order: Validate Before Canonicalize

View all
CVE-2026-24895 CRITICAL POC
9.8
CVE-2026-39364 HIGH POC
8.2
CVE-2026-69246 HIGH POC
7.2
CVE-2026-69245 MEDIUM POC
6.5
CVE-2022-26136 CRITICAL
9.8
CVE-2026-73420 CRITICAL
9.1
CVE-2026-82481 HIGH
8.7
CVE-2022-26137 HIGH
8.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 16.1 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-34786 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy