Rack EUVD-2026-18378

This is a moderate but genuine denial of service concern. The CVSS score of 5.3 reflects the low attack complexity (AC:L), no privilege requirements (PR:N), and unauthenticated accessibility (as confirmed by CVSS vector), yielding medium-range severity despite low integrity/confidentiality impact. The attack vector is network-based (AV:N), requiring only a single malformed HTTP request. The absence of active exploitation data (KEV status not indicated, no public POC referenced) suggests this is not yet widely targeted, but the trivial attack surface-a single HTTP header-and the simplicity of crafting wildcard-filled Accept-Encoding values (no special payload encoding needed) mean exploitation requires minimal sophistication. The quadratic complexity issue is a classic algorithmic vulnerability; CPU exhaustion through header manipulation is straightforward to exploit at scale. From a SSVC decision framework: exploitation is feasible (clear attack path, no unusual conditions), the technical impact is availability denial (service disruption), and automated attacks are highly plausible (HTTP header injection trivializes this). Organizations running unpatched Rack-based applications (including Rails applications using Rack::Deflater, which is common for performance) face real resource exhaustion risk, particularly in environments with resource constraints or high request volume.

An attacker sends a single HTTP GET request to a vulnerable Rails application with a crafted Accept-Encoding header containing dozens or hundreds of wildcard (*) entries, such as Accept-Encoding: *, *, *, ... (repeated). The Rack::Deflater middleware processes the request and invokes Rack::Utils.select_best_encoding to determine encoding, triggering quadratic-time processing of the wildcard entries. This consumes significant CPU for the duration of that single request processing cycle. If repeated across multiple concurrent requests or in a loop, the attacker exhausts the application's CPU resources, causing request timeouts, delayed responses, or complete service unavailability for legitimate users. No special authentication or elevated privileges are required; the attacker need only craft a single HTTP request.