Red Hat CVE-2026-34835

Rack is a widely-used modular Ruby web application server interface that standardizes HTTP request/response handling. The vulnerability stems from the AUTHORITY regular expression used to parse the Host header in Rack::Request, which does not strictly enforce RFC 3986 compliance. RFC 3986 defines a hostname (reg-name) as a sequence of unreserved and percent-encoded characters; however, the Rack regex incorrectly permits reserved characters such as forward slash (/), question mark (?), hash (#), and at-sign (@) that should delimit URI components in compliant implementations. When applications extract the hostname via req.host, req.url, or req.base_url and perform validation using only prefix or suffix checks (e.g., checking if the hostname starts with or ends with a trusted domain), attackers can inject these special characters to bypass the checks while the malformed host value propagates into generated links, redirects, or origin validation logic. The root cause is classified under CWE-1286 (Improper Validation of Syntactic Correctness of Input), reflecting insufficient grammar validation of the Host header format.