Skip to main content

Rack CVE-2026-34835

| EUVDEUVD-2026-18478 MEDIUM
Improper Validation of Syntactic Correctness of Input (CWE-1286)
2026-04-02 GitHub_M GHSA-g2pf-xv49-m2h5
Authentication Bypass Rack
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
SUSE
4.8 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat
4.8 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

5
CVSS changed
Jul 24, 2026 - 21:22 NVD
4.8 (MEDIUM) 6.5 (MEDIUM)
Patch released
Apr 03, 2026 - 02:30 nvd
Patch available
EUVD ID Assigned
Apr 02, 2026 - 17:30 euvd
EUVD-2026-18478
Analysis Generated
Apr 02, 2026 - 17:30 vuln.today
CVE Published
Apr 02, 2026 - 17:09 nvd
MEDIUM 4.8

DescriptionNVD

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host header using an AUTHORITY regular expression that accepts characters not permitted in RFC-compliant hostnames, including /, ?, #, and @. Because req.host returns the full parsed value, applications that validate hosts using naive prefix or suffix checks can be bypassed. This can lead to host header poisoning in applications that use req.host, req.url, or req.base_url for link generation, redirects, or origin validation. This issue has been patched in versions 3.1.21 and 3.2.6.

AnalysisAI

Host header validation bypass in Rack 3.0.0.beta1-3.1.20 and 3.2.0-3.2.5 allows unauthenticated remote attackers to poison Host headers by injecting RFC-noncompliant characters (/, ?, #, @) that pass the AUTHORITY regex but are accepted by req.host, req.url, and req.base_url. Applications relying on naive prefix or suffix matching for host validation, link generation, or origin checks can be bypassed, enabling host header poisoning attacks. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

Rack is a widely-used modular Ruby web application server interface that standardizes HTTP request/response handling. The vulnerability stems from the AUTHORITY regular expression used to parse the Host header in Rack::Request, which does not strictly enforce RFC 3986 compliance. RFC 3986 defines a hostname (reg-name) as a sequence of unreserved and percent-encoded characters; however, the Rack regex incorrectly permits reserved characters such as forward slash (/), question mark (?), hash (#), and at-sign (@) that should delimit URI components in compliant implementations. When applications extract the hostname via req.host, req.url, or req.base_url and perform validation using only prefix or suffix checks (e.g., checking if the hostname starts with or ends with a trusted domain), attackers can inject these special characters to bypass the checks while the malformed host value propagates into generated links, redirects, or origin validation logic. The root cause is classified under CWE-1286 (Improper Validation of Syntactic Correctness of Input), reflecting insufficient grammar validation of the Host header format.

RemediationAI

Upgrade Rack to version 3.1.21 or 3.2.6 or later, whichever matches your current release branch. In the interim, applications should implement strict RFC 3986-compliant hostname validation using allowlist-based checks rather than prefix/suffix matching, and audit any use of req.host, req.url, or req.base_url in security-sensitive contexts such as origin validation, link generation, and redirects. Additional defensive measures include validating the Host header against a whitelist of permitted domains before use and implementing Origin header verification where feasible. See the GitHub Security Advisory at https://github.com/rack/rack/security/advisories/GHSA-g2pf-xv49-m2h5 for detailed guidance.

More in Rack

View all
CVE-2026-22860 HIGH POC
7.5 Feb 18

Directory traversal in Rack versions prior to 2.2.22, 3.1.20, and 3.2.5 allows unauthenticated remote attackers to list

CVE-2024-26141 HIGH POC
7.5 Feb 29

Rack is a modular Ruby web server interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable,
CVE-2024-25126 HIGH POC
7.5 Feb 29

Rack is a modular Ruby web server interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable,
CVE-2020-8184 HIGH POC
7.5 Jun 19

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 tha
CVE-2022-30123 CRITICAL
10.0 Dec 05

A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell

CVE-2025-25184 MEDIUM POC
5.7 Feb 12

Rack provides an interface for developing web applications in Ruby. Rated medium severity (CVSS 5.7), this vulnerability
CVE-2026-25500 MEDIUM POC
5.4 Feb 18

Rack's Directory module fails to sanitize filenames when generating HTML directory listings, allowing attackers to craft
CVE-2020-8161 HIGH
8.6 Jul 02

A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerabi
CVE-2013-0263 MEDIUM
5.1 Feb 08

Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x
CVE-2025-46727 HIGH
7.5 May 07

Rack is a modular Ruby web server interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable,
CVE-2015-3225 MEDIUM
5.0 Jul 26

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products
CVE-2025-59830 HIGH
7.5 Sep 25

Rack is a modular Ruby web server interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable,

Same weakness CWE-1286 – Improper Validation of Syntactic Correctness of Input

View all
CVE-2024-6284 MEDIUM POC
6.3
CVE-2025-10954 MEDIUM POC
5.5
CVE-2024-6763 MEDIUM POC
5.3
CVE-2021-31988 HIGH
8.8
CVE-2026-57026 HIGH
8.7
CVE-2026-33778 HIGH
8.7
CVE-2025-8873 HIGH
8.7
CVE-2024-39542 HIGH
8.7

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 16.1 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Public Cloud 15 SP7 Fixed

Share

CVE-2026-34835 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy