CVE-2026-34826

Summary

Rack::Utils.get_byte_ranges parses the HTTP Range header without limiting the number of individual byte ranges. Although the existing fix for CVE-2024-26141 rejects ranges whose total byte coverage exceeds the file size, it does not restrict the count of ranges. An attacker can supply many small overlapping ranges such as 0-0,0-0,0-0,... to trigger disproportionate CPU, memory, I/O, and bandwidth consumption per request.

This results in a denial of service condition in Rack file-serving paths that process multipart byte range responses.

Details

Rack::Utils.get_byte_ranges accepts a comma-separated list of byte ranges and validates them based on their aggregate size, but does not impose a limit on how many individual ranges may be supplied.

As a result, a request such as:

Range: bytes=0-0,0-0,0-0,0-0,...

can contain thousands of overlapping one-byte ranges while still satisfying the total-size check added for CVE-2024-26141.

When such a header is processed by Rack’s file-serving code, each range causes additional work, including multipart response generation, per-range iteration, file seek and read operations, and temporary string allocation for response size calculation and output. This allows a relatively small request header to trigger disproportionately expensive processing and a much larger multipart response.

The issue is distinct from CVE-2024-26141. That fix prevents range sets whose total byte coverage exceeds the file size, but does not prevent a large number of overlapping ranges whose summed size remains within that limit.

Impact

Applications that expose file-serving paths with byte range support may be vulnerable to denial of service.

An unauthenticated attacker can send crafted Range headers containing many small overlapping ranges to consume excessive CPU time, memory, file I/O, and bandwidth. Repeated requests may reduce application availability and increase pressure on workers and garbage collection.

Mitigation

• Update to a patched version of Rack that limits the number of accepted byte ranges.
• Reject or normalize multipart byte range requests containing excessive range counts.
• Consider disabling multipart range support where it is not required.
• Apply request filtering or header restrictions at the reverse proxy or application boundary to limit abusive Range headers.

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.get_byte_ranges parses the HTTP Range header without limiting the number of individual byte ranges. Although the existing fix for CVE-2024-26141 rejects ranges whose total byte coverage exceeds the file size, it does not restrict the count of ranges. An attacker can supply many small overlapping ranges such as 0-0,0-0,0-0,... to trigger disproportionate CPU, memory, I/O, and bandwidth consumption per request. This results in a denial of service condition in Rack file-serving paths that process multipart byte range responses. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

CVE-2026-26961 Greedy multipart boundary parsing can cause parser differentials and WAF bypass. Forwarded header semicolon injection enables Host and Scheme spoofing. CVE-2026-34230 Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header. CVE-2026-34763 Root directory disclosure via unescaped regex interpolation in Rack::Directory. CVE-2026-34785 Rack::Static prefix matching can expose unintended files under the static root. CVE-2026-34786 Rack::Static header_rules bypass via URL-encoded path mismatch. CVE-2026-34826 Multipart byte range processing allows denial of service via excessive overlapping ranges. CVE-2026-34827 Multipart header parsing allows denial of service via escape-heavy quoted parameters. CVE-2026-34829 Multipart parsing without Content-Length header allows unbounded chunked file uploads. CVE-2026-34830 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect. CVE-2026-34831 Content-Length mismatch in Rack::Files error responses. CVE-2026-34835 Rack::Request accepts invalid Host characters, enabling host allowlist bypass.

These are all security issues fixed in the ruby4.0-rubygem-rack-2.2-2.2.23-1.1 package on the GA media of openSUSE Tumbleweed.

This update for rmt-server fixes the following issues:

Update to version 3.1 (bsc#1274715).

Security issues fixed:

• CVE-2026-26961: rack: greedy multipart boundary parsing can lead to parser differentials and WAF bypass (bsc#1261398).
• CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to downstream header injection and response splitting(bsc#1261471).
• CVE-2026-34763: rack: unescaped regex interpolation of configured root path can lead to root directory disclosure (bsc#1261406).
• CVE-2026-34230: rack: crafted Accept-Encoding headers can cause a denial of service (bsc#1261388).
• CVE-2026-34785: rack: prefix matching logic can lead to the exposure of unintended files under the static root (bsc#1261417).
• CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
• CVE-2026-34826: rack: missing individual byte range limit checks when parsing HTTP Range headers can lead to excessive resource consumption and a denial of service (bsc#1261436).
• CVE-2026-34829: rack: multipart parsing without Content-Length header can lead to unbounded chunked file uploads and a denial of service (bsc#1261447).
• CVE-2026-34230: rack: quadratic complexity when processing of wildcard Accept-Encoding headers can lead to a denial of service (bsc#1261388).
• CVE-2026-34830: rack: improper sanitization of the X-Accel-Mapping request header can lead to the exposure of unintended files via X-Accel-Redirect (bsc#1261458).
• CVE-2026-34831: rack: Content-Length header and body byte size mismatch when creating error responses can lead to incorrect HTTP response framing (bsc#1261466).

Other updates and bugfixes:

• Version 3.1:
  • Remove all errors and warnigs due to new Ruby and Ruby on Rails versions
• Version 2.28:
  • Set arch to unknown for Rancher based products (jsc#SCC-759)
  • Fix purge for large amount of systems (bsc#1262706)
  • Change data type to MEDIUMTEXT in profiles table (bsc#1268305)
  • Remove proxy_byos column
  • Fix race condition when no system matches (bsc#1268301)
  • Fix race condition for PAYG (bsc#1268149)
  • Fix race condition to update a system (bsc#1268303)
• Version 2.27:
  • Fix ReDoS vulnerability in Addressable
  • Fixes out-of-bounds read vulnerability in rdiscount

This update for rmt-server fixes the following issues:

Update to version 2.27.

Security issues fixed:

• CVE-2026-26961: rack: greedy multipart boundary parsing can lead to parser differentials and WAF bypass (bsc#1261398).
• CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to downstream header injection and response splitting(bsc#1261471).
• CVE-2026-34763: rack: unescaped regex interpolation of configured root path can lead to root directory disclosure (bsc#1261406).
• CVE-2026-34785: rack: prefix matching logic can lead to the exposure of unintended files under the static root (bsc#1261417).
• CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
• CVE-2026-34826: rack: missing individual byte range limit checks when parsing HTTP Range headers can lead to excessive resource consumption and a denial of service (bsc#1261436).
• CVE-2026-34829: rack: multipart parsing without Content-Length header can lead to unbounded chunked file uploads and a denial of service (bsc#1261447).
• CVE-2026-34230: rack: quadratic complexity when processing of wildcard Accept-Encoding headers can lead to a denial of service (bsc#1261388).
• CVE-2026-34830: rack: improper sanitization of the X-Accel-Mapping request header can lead to the exposure of unintended files via X-Accel-Redirect (bsc#1261458).
• CVE-2026-34831: rack: Content-Length header and body byte size mismatch when creating error responses can lead to incorrect HTTP response framing (bsc#1261466).

Other updates and bugfixes:

• Fix ReDoS in Addressable.
• Fix out-of-bounds read in rdiscount.

This update for rmt-server fixes the following issues

• CVE-2026-26961: rack: mismatch in header handling can allow to smuggle multipart content (bsc#1261398).
• CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to header injection or response splitting (bsc#1261471).
• CVE-2026-34230: rack: crafted Accept-Encoding header can cause a denial of service (bsc#1261388).
• CVE-2026-34763: rack: failing of the prefix stripping can lead to information disclosure (bsc#1261406).
• CVE-2026-34785: rack: prefix matching can expose unintended files under the static root (bsc#1261417).
• CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
• CVE-2026-34826: rack: multipart byte range processing can allow denial of service (bsc#1261436).
• CVE-2026-34829: rack: multipart parsing without Content-Length header allows unbounded chunked file uploads (bsc#1261447).
• CVE-2026-34830: rack: crafted X-Accel-Mappingheaders can lead to regex injection (bsc#1261458).
• CVE-2026-34831: rack: Content-Length mismatch can lead to incorrectly framed error responses (bsc#1261466).

Other fixes:

• Update to version 2.27

This update for rmt-server fixes the following issues:

Update to version 3.1 (bsc#1274715).

Security issues fixed:

• CVE-2026-26961: rack: greedy multipart boundary parsing can lead to parser differentials and WAF bypass (bsc#1261398).
• CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to downstream header injection and response splitting(bsc#1261471).
• CVE-2026-34763: rack: unescaped regex interpolation of configured root path can lead to root directory disclosure (bsc#1261406).
• CVE-2026-34230: rack: crafted Accept-Encoding headers can cause a denial of service (bsc#1261388).
• CVE-2026-34785: rack: prefix matching logic can lead to the exposure of unintended files under the static root (bsc#1261417).
• CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
• CVE-2026-34826: rack: missing individual byte range limit checks when parsing HTTP Range headers can lead to excessive resource consumption and a denial of service (bsc#1261436).
• CVE-2026-34829: rack: multipart parsing without Content-Length header can lead to unbounded chunked file uploads and a denial of service (bsc#1261447).
• CVE-2026-34230: rack: quadratic complexity when processing of wildcard Accept-Encoding headers can lead to a denial of service (bsc#1261388).
• CVE-2026-34830: rack: improper sanitization of the X-Accel-Mapping request header can lead to the exposure of unintended files via X-Accel-Redirect (bsc#1261458).
• CVE-2026-34831: rack: Content-Length header and body byte size mismatch when creating error responses can lead to incorrect HTTP response framing (bsc#1261466).

Other updates and bugfixes:

• Version 3.1:
  • Remove all errors and warnigs due to new Ruby and Ruby on Rails versions
• Version 2.28:
  • Set arch to unknown for Rancher based products (jsc#SCC-759)
  • Fix purge for large amount of systems (bsc#1262706)
  • Change data type to MEDIUMTEXT in profiles table (bsc#1268305)
  • Remove proxy_byos column
  • Fix race condition when no system matches (bsc#1268301)
  • Fix race condition for PAYG (bsc#1268149)
  • Fix race condition to update a system (bsc#1268303)
• Version 2.27:
  • Fix ReDoS vulnerability in Addressable
  • Fixes out-of-bounds read vulnerability in rdiscount

This update for rmt-server fixes the following issues

• CVE-2026-26961: rack: mismatch in header handling can allow to smuggle multipart content (bsc#1261398).
• CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to header injection or response splitting (bsc#1261471).
• CVE-2026-34230: rack: crafted Accept-Encoding header can cause a denial of service (bsc#1261388).
• CVE-2026-34763: rack: failing of the prefix stripping can lead to information disclosure (bsc#1261406).
• CVE-2026-34785: rack: prefix matching can expose unintended files under the static root (bsc#1261417).
• CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
• CVE-2026-34826: rack: multipart byte range processing can allow denial of service (bsc#1261436).
• CVE-2026-34829: rack: multipart parsing without Content-Length header allows unbounded chunked file uploads (bsc#1261447).
• CVE-2026-34830: rack: crafted X-Accel-Mappingheaders can lead to regex injection (bsc#1261458).
• CVE-2026-34831: rack: Content-Length mismatch can lead to incorrectly framed error responses (bsc#1261466).

Changes for rmt-server:

• Updated to version 2.27

Andrew Lacambra discovered that Rack did not properly parse certain regular expressions. An attacker could possibly use this issue to bypass network security filters. (CVE-2026-26961)

William T. Nelson discovered that Rack did not handle multipart headers correctly. An attacker could possibly use this issue to cause downstream parsing issues or a denial of service. (CVE-2026-26962)

It was discovered that Rack did not handle the Forwarded header correctly. An attacker could possibly use this issue to manipulate header values. (CVE-2026-32762)

It was discovered that Rack could consume excessive CPU when handling certain Accept-Encoding values. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34230)

Haruki Oyama discovered that certain configurations of Rack could erroneously fail to derive the displayed directory path, and expose the full file system path. An attacker could possibly use this issue to disclose deployment details such as layout and usernames. (CVE-2026-34763)

It was discovered that Rack did not properly handle static file paths. An attacker could possibly use this issue to exfiltrate unintentionally served data. (CVE-2026-34785)

Haruki Oyama discovered that Rack did not apply header rules to certain requests for URL-encoded static paths. An attacker could possibly use this issue to bypass security-relevant response headers. (CVE-2026-34786)

It was discovered that Rack did not limit the number of ranges requested in the Range header. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34826)

It was discovered that Rack could consume excessive CPU when parsing certain multipart parameters. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34827)

It was discovered that Rack could consume unbounded disk space when handling requests without a Content-Length header. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34829)

Mehtab Zafar discovered that Rack directly interpreted the X-Accel-Mapping header as a regular expression without escaping. An attacker could possibly use this issue to exfiltrate arbitrary files from internal locations. (CVE-2026-34830)

It was discovered that Rack did not properly handle messages with Unicode. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34831)

It was discovered that Rack did not properly parse the Host header. An attacker could possibly use this issue to bypass security filters or poison generated links. (CVE-2026-34835)