Rack EUVD-2026-18386

The CVSS score of 5.3 (Medium) reflects a network-based denial of service with low attack complexity and no authentication requirement (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). The attack vector is straightforward - a single malformed HTTP request - making this exploitable by any network-connected attacker. However, the impact is confined to availability; no confidentiality or integrity breaches are possible. EPSS data is not provided, but the nature of the vulnerability (unbounded resource consumption via trivial input manipulation) suggests a moderate-to-high real-world probability of exploitation. The KEV (Known Exploited Vulnerabilities) status is not confirmed in the provided data, and no public exploit code has been independently reported. SSVC considerations: exploitation is likely automatic (straightforward HTTP manipulation), the technical impact is high for affected services, and the automatable nature means defenders must patch promptly. This is a genuine priority for Rack deployments serving file content, particularly those exposed to untrusted networks, but not a critical emergency; the attack requires service to be actively engaged in range request handling.

An attacker sends an HTTP GET request with a malicious Range header such as 'Range: bytes=0-0,0-0,0-0,...' (repeated 10,000+ times) to a Ruby web server using vulnerable Rack. The server attempts to parse and process this header, allocating memory and CPU cycles for each range entry even though they are identical and overlapping. If the application serves files via multipart/byteranges response (a legitimate HTTP feature), the server must construct and transmit a response with 10,000+ boundary sections and content, rapidly exhausting resources. Multiple such requests from a single attacker or distributed network quickly degrade service availability for legitimate users. No special network access, authentication, or user interaction is required; the attack succeeds with a standard HTTP request to any Rack-based file-serving endpoint.