Rack CVE-2026-34831

CVSS score of 4.8 with attack vector network, high complexity, and no privilege requirement indicates low-to-moderate severity. The CVSS vector (AV:N/AC:H/PR:N/UI:N) reflects that while exploitation requires crafting specific percent-encoded UTF-8 paths (explaining high complexity), the attack is network-accessible without authentication. The information disclosure and integrity impacts (C:L/I:L per CVSS) are limited to HTTP response desynchronization scenarios. Real-world risk depends on deployment architecture: applications using persistent HTTP connections with strict Content-Length enforcement (load balancers, WAFs, proxies) face higher risk of response confusion and potential data leakage. However, most modern HTTP clients and servers handle this gracefully. The absence of public exploit code or KEV status suggests this is a logic error rather than an easily weaponized vulnerability, making it lower priority than the CVSS alone suggests. Patching is recommended as a routine maintenance task rather than emergency action.

An attacker sends an HTTP request to a Rack-based application for a non-existent path containing percent-encoded UTF-8 characters, such as /api/users/%F0%9F%98%80 (the emoji 😀 percent-encoded). The 404 response from Rack::Files includes the requested path in the error message, causing the response body to contain multibyte UTF-8 sequences. The Content-Length header is calculated using String#size, reporting fewer bytes than actually transmitted. If the request is made over a persistent HTTP connection to an intermediate proxy or load balancer that strictly enforces Content-Length boundaries, the mismatch causes the proxy to read only the first N bytes, leaving subsequent bytes in the buffer that are incorrectly attributed to the next HTTP request, resulting in response desynchronization.