Red Hat EUVD-2026-18386

Rack is a foundational Ruby web application interface that standardizes HTTP server communication. The vulnerability exists in the Rack::Utils.get_byte_ranges method, which parses the HTTP Range header (RFC 7233) to support partial content delivery and resume functionality. The root cause is classified as CWE-400 (Uncontrolled Resource Consumption), specifically the lack of a limit on the count of individual byte ranges within a single Range header. While the prior CVE-2024-26141 patch added validation to reject ranges whose combined byte coverage exceeds the file size, it did not implement a cap on the number of distinct ranges. An attacker can craft a Range header containing hundreds or thousands of small, overlapping ranges (e.g., 'bytes=0-0,0-0,0-0,...') that individually pass validation but collectively trigger excessive parsing, memory allocation, and I/O operations when the server constructs multipart/byteranges responses.