Red Hat CVE-2026-34831

Rack is a minimal Ruby web application interface specification that abstracts HTTP server operations. The vulnerability exists in the Rack::Files middleware class, specifically the #fail method responsible for generating 404 error responses. The root cause is CWE-130 (Improper Handling of Length Parameters), where String#size counts UTF-8 characters rather than bytes, while HTTP Content-Length headers must specify byte counts. When a 404 response body contains multibyte UTF-8 sequences (triggered by percent-encoded UTF-8 in the requested path being reflected in the error message), the mismatch between declared Content-Length and actual transmitted bytes violates HTTP response framing semantics. This can cause HTTP clients or intermediate proxies that enforce strict Content-Length validation to incorrectly parse response boundaries, leading to response desynchronization where subsequent requests on persistent connections read incorrect data.