Skip to main content

Rack CVE-2026-34830

| EUVDEUVD-2026-18390 HIGH
Permissive Regular Expression (CWE-625)
2026-04-02 security-advisories@github.com GHSA-qv7j-4883-hwh7
Code Injection Nginx Rack
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Red Hat
5.9 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

7
Re-analysis Queued
Jul 24, 2026 - 21:22 vuln.today
cvss_changed
Severity Changed
Jul 24, 2026 - 21:22 NVD
MEDIUM HIGH
CVSS changed
Jul 24, 2026 - 21:22 NVD
5.9 (MEDIUM) 7.5 (HIGH)
Patch released
Apr 03, 2026 - 02:30 nvd
Patch available
EUVD ID Assigned
Apr 02, 2026 - 17:22 euvd
EUVD-2026-18390
Analysis Generated
Apr 02, 2026 - 17:22 vuln.today
CVE Published
Apr 02, 2026 - 17:16 nvd
MEDIUM 5.9

DescriptionNVD

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is not escaped, an attacker who can supply X-Accel-Mapping to the backend can inject regex metacharacters and control the generated X-Accel-Redirect response header. In deployments using Rack::Sendfile with x-accel-redirect, this can allow an attacker to cause nginx to serve unintended files from configured internal locations. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

AnalysisAI

Rack::Sendfile in versions prior to 2.2.23, 3.1.21, and 3.2.6 allows remote attackers to inject regex metacharacters into X-Accel-Mapping request headers, enabling unescaped interpolation that manipulates the X-Accel-Redirect response header and causes nginx to serve unintended files from internal locations. No public exploit code or active exploitation has been confirmed; patch versions are available from the vendor.

Technical ContextAI

Rack is a modular Ruby web server interface that provides middleware components for HTTP request/response handling. The vulnerable component, Rack::Sendfile, implements acceleration for file downloads by delegating to nginx via X-Accel-Redirect headers (also known as x-accel-redirect). The Sendfile middleware uses the X-Accel-Mapping request header to rewrite file paths for internal nginx location directives. The vulnerability stems from CWE-625 (Unsafe Regular Expression Complexity) where user-supplied input from the X-Accel-Mapping header is directly interpolated into a regular expression pattern without escaping metacharacters. This allows attackers to craft regex patterns that match unintended file paths, causing nginx to redirect file serving to arbitrary configured internal locations rather than the intended target.

RemediationAI

Upgrade Rack to version 2.2.23 (for 2.2.x branch), 3.1.21 (for 3.1.x branch), or 3.2.6 (for 3.2.x branch) or later. For Rails applications, this typically requires updating the Gemfile and running bundle update rack, then redeploying. No workarounds are available short of disabling Rack::Sendfile or removing X-Accel-Mapping support entirely. Verify that your application's Gemfile.lock specifies one of the patched versions after remediation. Additional defense-in-depth: ensure nginx x-accel-redirect internal locations are explicitly defined and as restrictive as possible to limit the blast radius of any path manipulation. See vendor advisory at https://github.com/rack/rack/security/advisories/GHSA-qv7j-4883-hwh7 for details.

More in Rack

View all
CVE-2026-22860 HIGH POC
7.5 Feb 18

Directory traversal in Rack versions prior to 2.2.22, 3.1.20, and 3.2.5 allows unauthenticated remote attackers to list

CVE-2024-26141 HIGH POC
7.5 Feb 29

Rack is a modular Ruby web server interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable,
CVE-2024-25126 HIGH POC
7.5 Feb 29

Rack is a modular Ruby web server interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable,
CVE-2020-8184 HIGH POC
7.5 Jun 19

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 tha
CVE-2022-30123 CRITICAL
10.0 Dec 05

A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell

CVE-2025-25184 MEDIUM POC
5.7 Feb 12

Rack provides an interface for developing web applications in Ruby. Rated medium severity (CVSS 5.7), this vulnerability
CVE-2026-25500 MEDIUM POC
5.4 Feb 18

Rack's Directory module fails to sanitize filenames when generating HTML directory listings, allowing attackers to craft
CVE-2026-39324 CRITICAL
9.3 Apr 07

Session authentication bypass in Rack::Session::Cookie 2.0.0 through 2.1.1 allows unauthenticated remote attackers to fo
CVE-2020-8161 HIGH
8.6 Jul 02

A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerabi
CVE-2013-0263 MEDIUM
5.1 Feb 08

Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x
CVE-2025-46727 HIGH
7.5 May 07

Rack is a modular Ruby web server interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable,
CVE-2015-3225 MEDIUM
5.0 Jul 26

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products

Same weakness CWE-625 – Permissive Regular Expression

View all
CVE-2026-64940 HIGH
8.8
CVE-2026-32973 HIGH
8.8
CVE-2018-8926 HIGH
8.8
CVE-2026-19278 MEDIUM
6.8
CVE-2026-23651 MEDIUM
6.7
CVE-2020-8910 MEDIUM
6.5
CVE-2026-82726 MEDIUM
6.3
CVE-2026-34763 MEDIUM
5.3

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 16.1 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-34830 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy