Red Hat EUVD-2026-18378

Rack is a foundational Ruby web server interface library that provides middleware components for HTTP request/response handling. The Rack::Utils.select_best_encoding method processes the Accept-Encoding HTTP header to determine optimal compression algorithms for responses. The vulnerability stems from a CWE-400 uncontrolled resource consumption flaw: when the Accept-Encoding header contains numerous wildcard (*) entries, the algorithm exhibits quadratic time complexity in processing these values. Rack::Deflater, a widely-used middleware component, directly invokes this method to select response encoding, making the compression pipeline a direct attack vector. The issue affects Rack across multiple major versions: 2.x series prior to 2.2.23, 3.1.x prior to 3.1.21, and 3.2.x prior to 3.2.6. Applications using the CPE rack component (specifically rack-deflater) with any vulnerable version exposed.