Every CVE Search/ Get API key

CVE-2026-34829

Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length

7.5 HighFix available

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a BoundedIO when CONTENT_LENGTH is present. When a multipart/form-data request is sent without a Content-Length header, such as with HTTP chunked transfer encoding, multipart parsing continues until end-of-stream with no total size limit. For file parts, the uploaded body is written directly to a temporary file on disk rather than being constrained by the buffered in-memory upload limit. An unauthenticated attacker can therefore stream an arbitrarily large multipart file upload and consume unbounded disk space. This results in a denial of service condition for Rack applications that accept multipart form data. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.38%Up 0.3 points since Apr 3, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a BoundedIO when CONTENT_LENGTH is present. When a multipart/form-data request is sent without a Content-Length header, such as with HTTP chunked transfer encoding, multipart parsing continues until end-of-stream with no total size limit. For file parts, the uploaded body is written directly to a temporary file on disk rather than being constrained by the buffered in-memory upload limit. An unauthenticated attacker can therefore stream an arbitrarily large multipart file upload and consume unbounded disk space. This results in a denial of service condition for Rack applications that accept multipart form data. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

Record
CVE-2026-34829
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770, CWE-770
Updated
2026-11-02
EUVDEUVD-2026-18388 7.5

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a BoundedIO when CONTENT_LENGTH is present. When a multipart/form-data request is sent without a Content-Length header, such as with HTTP chunked transfer encoding, multipart parsing continues until end-of-stream with no total size limit. For file parts, the uploaded body is written directly to a temporary file on disk rather than being constrained by the buffered in-memory upload limit. An unauthenticated attacker can therefore stream an arbitrarily large multipart file upload and consume unbounded disk space. This results in a denial of service condition for Rack applications that accept multipart form data. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

Record
EUVD-2026-18388
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-8vqr-qjwx-82mw 7.5

Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads

Summary

Rack::Multipart::Parser only wraps the request body in a BoundedIO when CONTENT_LENGTH is present. When a multipart/form-data request is sent without a Content-Length header, such as with HTTP chunked transfer encoding, multipart parsing continues until end-of-stream with no total size limit.

For file parts, the uploaded body is written directly to a temporary file on disk rather than being constrained by the buffered in-memory upload limit. An unauthenticated attacker can therefore stream an arbitrarily large multipart file upload and consume unbounded disk space.

This results in a denial of service condition for Rack applications that accept multipart form data.

Details

Rack::Multipart::Parser.parse applies BoundedIO only when content_length is not nil:

io = BoundedIO.new(io, content_length) if content_length

When CONTENT_LENGTH is absent, the parser reads the multipart body until EOF without a global byte limit.

Although Rack enforces BUFFERED_UPLOAD_BYTESIZE_LIMIT for retained non-file parts, file uploads are handled differently. When a multipart part includes a filename, the body is streamed to a Tempfile, and the retained-size accounting is not applied to that file content. As a result, file parts are not subject to the same upload size bound.

An attacker can exploit this by sending a chunked multipart/form-data request containing a file part and continuously streaming data without declaring a Content-Length. Rack will continue writing the uploaded data to disk until the client stops or the server exhausts available storage.

Impact

Any Rack application that accepts multipart/form-data uploads may be affected if no upstream component enforces a request body size limit.

An unauthenticated attacker can send a large chunked file upload to consume disk space on the application host. This may cause request failures, application instability, or broader service disruption if the host runs out of available storage.

The practical impact depends on deployment architecture. Reverse proxies or application servers that enforce upload limits may reduce or eliminate exploitability, but Rack itself does not impose a total multipart upload limit in this code path when CONTENT_LENGTH is absent.

Mitigation

  • Update to a patched version of Rack that enforces a total multipart upload size limit even when CONTENT_LENGTH is absent.
  • Enforce request body size limits at the reverse proxy or application server.
  • Isolate temporary upload storage and monitor disk consumption for multipart endpoints.
Record
GHSA-8vqr-qjwx-82mw
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
NVD 7.5

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a BoundedIO when CONTENT_LENGTH is present. When a multipart/form-data request is sent without a Content-Length header, such as with HTTP chunked transfer encoding, multipart parsing continues until end-of-stream with no total size limit. For file parts, the uploaded body is written directly to a temporary file on disk rather than being constrained by the buffered in-memory upload limit. An unauthenticated attacker can therefore stream an arbitrarily large multipart file upload and consume unbounded disk space. This results in a denial of service condition for Rack applications that accept multipart form data. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

Record
CVE-2026-34829
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSV 7.5

Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a BoundedIO when CONTENT_LENGTH is present. When a multipart/form-data request is sent without a Content-Length header, such as with HTTP chunked transfer encoding, multipart parsing continues until end-of-stream with no total size limit. For file parts, the uploaded body is written directly to a temporary file on disk rather than being constrained by the buffered in-memory upload limit. An unauthenticated attacker can therefore stream an arbitrarily large multipart file upload and consume unbounded disk space. This results in a denial of service condition for Rack applications that accept multipart form data. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

Record
CVE-2026-34829
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSVDEBIAN-CVE-2026-34829 7.5

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a BoundedIO when CONTENT_LENGTH is present. When a multipart/form-data request is sent without a Content-Length header, such as with HTTP chunked transfer encoding, multipart parsing continues until end-of-stream with no total size limit. For file parts, the uploaded body is written directly to a temporary file on disk rather than being constrained by the buffered in-memory upload limit. An unauthenticated attacker can therefore stream an arbitrarily large multipart file upload and consume unbounded disk space. This results in a denial of service condition for Rack applications that accept multipart form data. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

Record
DEBIAN-CVE-2026-34829
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 10 moreShow less
OSVGHSA-8vqr-qjwx-82mw 7.5

Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads

Summary

Rack::Multipart::Parser only wraps the request body in a BoundedIO when CONTENT_LENGTH is present. When a multipart/form-data request is sent without a Content-Length header, such as with HTTP chunked transfer encoding, multipart parsing continues until end-of-stream with no total size limit.

For file parts, the uploaded body is written directly to a temporary file on disk rather than being constrained by the buffered in-memory upload limit. An unauthenticated attacker can therefore stream an arbitrarily large multipart file upload and consume unbounded disk space.

This results in a denial of service condition for Rack applications that accept multipart form data.

Details

Rack::Multipart::Parser.parse applies BoundedIO only when content_length is not nil:

io = BoundedIO.new(io, content_length) if content_length

When CONTENT_LENGTH is absent, the parser reads the multipart body until EOF without a global byte limit.

Although Rack enforces BUFFERED_UPLOAD_BYTESIZE_LIMIT for retained non-file parts, file uploads are handled differently. When a multipart part includes a filename, the body is streamed to a Tempfile, and the retained-size accounting is not applied to that file content. As a result, file parts are not subject to the same upload size bound.

An attacker can exploit this by sending a chunked multipart/form-data request containing a file part and continuously streaming data without declaring a Content-Length. Rack will continue writing the uploaded data to disk until the client stops or the server exhausts available storage.

Impact

Any Rack application that accepts multipart/form-data uploads may be affected if no upstream component enforces a request body size limit.

An unauthenticated attacker can send a large chunked file upload to consume disk space on the application host. This may cause request failures, application instability, or broader service disruption if the host runs out of available storage.

The practical impact depends on deployment architecture. Reverse proxies or application servers that enforce upload limits may reduce or eliminate exploitability, but Rack itself does not impose a total multipart upload limit in this code path when CONTENT_LENGTH is absent.

Mitigation

  • Update to a patched version of Rack that enforces a total multipart upload size limit even when CONTENT_LENGTH is absent.
  • Enforce request body size limits at the reverse proxy or application server.
  • Isolate temporary upload storage and monitor disk consumption for multipart endpoints.
Record
GHSA-8vqr-qjwx-82mw
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSVUBUNTU-CVE-2026-34829 7.5

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a BoundedIO when CONTENT_LENGTH is present. When a multipart/form-data request is sent without a Content-Length header, such as with HTTP chunked transfer encoding, multipart parsing continues until end-of-stream with no total size limit. For file parts, the uploaded body is written directly to a temporary file on disk rather than being constrained by the buffered in-memory upload limit. An unauthenticated attacker can therefore stream an arbitrarily large multipart file upload and consume unbounded disk space. This results in a denial of service condition for Rack applications that accept multipart form data. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

Record
UBUNTU-CVE-2026-34829
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-04
OSVMGASA-2026-0226 No score

Updated ruby-rack packages fix security vulnerabilities

CVE-2026-26961 Greedy multipart boundary parsing can cause parser differentials and WAF bypass. Forwarded header semicolon injection enables Host and Scheme spoofing. CVE-2026-34230 Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header. CVE-2026-34763 Root directory disclosure via unescaped regex interpolation in Rack::Directory. CVE-2026-34785 Rack::Static prefix matching can expose unintended files under the static root. CVE-2026-34786 Rack::Static header_rules bypass via URL-encoded path mismatch. CVE-2026-34826 Multipart byte range processing allows denial of service via excessive overlapping ranges. CVE-2026-34827 Multipart header parsing allows denial of service via escape-heavy quoted parameters. CVE-2026-34829 Multipart parsing without Content-Length header allows unbounded chunked file uploads. CVE-2026-34830 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect. CVE-2026-34831 Content-Length mismatch in Rack::Files error responses. CVE-2026-34835 Rack::Request accepts invalid Host characters, enabling host allowlist bypass.

Record
MGASA-2026-0226
Updated
2026-11-02
OSVopenSUSE-SU-2026:10508-1 No score

ruby4.0-rubygem-rack-2.2-2.2.23-1.1 on GA media

These are all security issues fixed in the ruby4.0-rubygem-rack-2.2-2.2.23-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10508-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21640-1 No score

Security update for rmt-server

This update for rmt-server fixes the following issues:

Update to version 3.1 (bsc#1274715).

Security issues fixed:

  • CVE-2026-26961: rack: greedy multipart boundary parsing can lead to parser differentials and WAF bypass (bsc#1261398).
  • CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to downstream header injection and response splitting(bsc#1261471).
  • CVE-2026-34763: rack: unescaped regex interpolation of configured root path can lead to root directory disclosure (bsc#1261406).
  • CVE-2026-34230: rack: crafted Accept-Encoding headers can cause a denial of service (bsc#1261388).
  • CVE-2026-34785: rack: prefix matching logic can lead to the exposure of unintended files under the static root (bsc#1261417).
  • CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
  • CVE-2026-34826: rack: missing individual byte range limit checks when parsing HTTP Range headers can lead to excessive resource consumption and a denial of service (bsc#1261436).
  • CVE-2026-34829: rack: multipart parsing without Content-Length header can lead to unbounded chunked file uploads and a denial of service (bsc#1261447).
  • CVE-2026-34230: rack: quadratic complexity when processing of wildcard Accept-Encoding headers can lead to a denial of service (bsc#1261388).
  • CVE-2026-34830: rack: improper sanitization of the X-Accel-Mapping request header can lead to the exposure of unintended files via X-Accel-Redirect (bsc#1261458).
  • CVE-2026-34831: rack: Content-Length header and body byte size mismatch when creating error responses can lead to incorrect HTTP response framing (bsc#1261466).

Other updates and bugfixes:

  • Version 3.1:
    • Remove all errors and warnigs due to new Ruby and Ruby on Rails versions
  • Version 2.28:
    • Set arch to unknown for Rancher based products (jsc#SCC-759)
    • Fix purge for large amount of systems (bsc#1262706)
    • Change data type to MEDIUMTEXT in profiles table (bsc#1268305)
    • Remove proxy_byos column
    • Fix race condition when no system matches (bsc#1268301)
    • Fix race condition for PAYG (bsc#1268149)
    • Fix race condition to update a system (bsc#1268303)
  • Version 2.27:
    • Fix ReDoS vulnerability in Addressable
    • Fixes out-of-bounds read vulnerability in rdiscount
Record
openSUSE-SU-2026:21640-1
Updated
2026-11-02
OSVSUSE-SU-2026:1745-1 No score

Security update for rmt-server

This update for rmt-server fixes the following issues:

Update to version 2.27.

Security issues fixed:

  • CVE-2026-26961: rack: greedy multipart boundary parsing can lead to parser differentials and WAF bypass (bsc#1261398).
  • CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to downstream header injection and response splitting(bsc#1261471).
  • CVE-2026-34763: rack: unescaped regex interpolation of configured root path can lead to root directory disclosure (bsc#1261406).
  • CVE-2026-34785: rack: prefix matching logic can lead to the exposure of unintended files under the static root (bsc#1261417).
  • CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
  • CVE-2026-34826: rack: missing individual byte range limit checks when parsing HTTP Range headers can lead to excessive resource consumption and a denial of service (bsc#1261436).
  • CVE-2026-34829: rack: multipart parsing without Content-Length header can lead to unbounded chunked file uploads and a denial of service (bsc#1261447).
  • CVE-2026-34230: rack: quadratic complexity when processing of wildcard Accept-Encoding headers can lead to a denial of service (bsc#1261388).
  • CVE-2026-34830: rack: improper sanitization of the X-Accel-Mapping request header can lead to the exposure of unintended files via X-Accel-Redirect (bsc#1261458).
  • CVE-2026-34831: rack: Content-Length header and body byte size mismatch when creating error responses can lead to incorrect HTTP response framing (bsc#1261466).

Other updates and bugfixes:

  • Fix ReDoS in Addressable.
  • Fix out-of-bounds read in rdiscount.
Record
SUSE-SU-2026:1745-1
Updated
2026-11-02
OSVSUSE-SU-2026:1964-1 No score

Security update for rmt-server

This update for rmt-server fixes the following issues

  • CVE-2026-26961: rack: mismatch in header handling can allow to smuggle multipart content (bsc#1261398).
  • CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to header injection or response splitting (bsc#1261471).
  • CVE-2026-34230: rack: crafted Accept-Encoding header can cause a denial of service (bsc#1261388).
  • CVE-2026-34763: rack: failing of the prefix stripping can lead to information disclosure (bsc#1261406).
  • CVE-2026-34785: rack: prefix matching can expose unintended files under the static root (bsc#1261417).
  • CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
  • CVE-2026-34826: rack: multipart byte range processing can allow denial of service (bsc#1261436).
  • CVE-2026-34829: rack: multipart parsing without Content-Length header allows unbounded chunked file uploads (bsc#1261447).
  • CVE-2026-34830: rack: crafted X-Accel-Mappingheaders can lead to regex injection (bsc#1261458).
  • CVE-2026-34831: rack: Content-Length mismatch can lead to incorrectly framed error responses (bsc#1261466).

Other fixes:

  • Update to version 2.27
Record
SUSE-SU-2026:1964-1
Updated
2026-11-02
OSVSUSE-SU-2026:23321-1 No score

Security update for rmt-server

This update for rmt-server fixes the following issues:

Update to version 3.1 (bsc#1274715).

Security issues fixed:

  • CVE-2026-26961: rack: greedy multipart boundary parsing can lead to parser differentials and WAF bypass (bsc#1261398).
  • CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to downstream header injection and response splitting(bsc#1261471).
  • CVE-2026-34763: rack: unescaped regex interpolation of configured root path can lead to root directory disclosure (bsc#1261406).
  • CVE-2026-34230: rack: crafted Accept-Encoding headers can cause a denial of service (bsc#1261388).
  • CVE-2026-34785: rack: prefix matching logic can lead to the exposure of unintended files under the static root (bsc#1261417).
  • CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
  • CVE-2026-34826: rack: missing individual byte range limit checks when parsing HTTP Range headers can lead to excessive resource consumption and a denial of service (bsc#1261436).
  • CVE-2026-34829: rack: multipart parsing without Content-Length header can lead to unbounded chunked file uploads and a denial of service (bsc#1261447).
  • CVE-2026-34230: rack: quadratic complexity when processing of wildcard Accept-Encoding headers can lead to a denial of service (bsc#1261388).
  • CVE-2026-34830: rack: improper sanitization of the X-Accel-Mapping request header can lead to the exposure of unintended files via X-Accel-Redirect (bsc#1261458).
  • CVE-2026-34831: rack: Content-Length header and body byte size mismatch when creating error responses can lead to incorrect HTTP response framing (bsc#1261466).

Other updates and bugfixes:

  • Version 3.1:
    • Remove all errors and warnigs due to new Ruby and Ruby on Rails versions
  • Version 2.28:
    • Set arch to unknown for Rancher based products (jsc#SCC-759)
    • Fix purge for large amount of systems (bsc#1262706)
    • Change data type to MEDIUMTEXT in profiles table (bsc#1268305)
    • Remove proxy_byos column
    • Fix race condition when no system matches (bsc#1268301)
    • Fix race condition for PAYG (bsc#1268149)
    • Fix race condition to update a system (bsc#1268303)
  • Version 2.27:
    • Fix ReDoS vulnerability in Addressable
    • Fixes out-of-bounds read vulnerability in rdiscount
Record
SUSE-SU-2026:23321-1
Updated
2026-11-02
OSVSUSE-SU-2026:2487-1 No score

Security update for rmt-server

This update for rmt-server fixes the following issues

  • CVE-2026-26961: rack: mismatch in header handling can allow to smuggle multipart content (bsc#1261398).
  • CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to header injection or response splitting (bsc#1261471).
  • CVE-2026-34230: rack: crafted Accept-Encoding header can cause a denial of service (bsc#1261388).
  • CVE-2026-34763: rack: failing of the prefix stripping can lead to information disclosure (bsc#1261406).
  • CVE-2026-34785: rack: prefix matching can expose unintended files under the static root (bsc#1261417).
  • CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
  • CVE-2026-34826: rack: multipart byte range processing can allow denial of service (bsc#1261436).
  • CVE-2026-34829: rack: multipart parsing without Content-Length header allows unbounded chunked file uploads (bsc#1261447).
  • CVE-2026-34830: rack: crafted X-Accel-Mappingheaders can lead to regex injection (bsc#1261458).
  • CVE-2026-34831: rack: Content-Length mismatch can lead to incorrectly framed error responses (bsc#1261466).

Changes for rmt-server:

  • Updated to version 2.27
Record
SUSE-SU-2026:2487-1
Updated
2026-11-02
OSVUSN-8989-1 No score

ruby-rack vulnerabilities

Andrew Lacambra discovered that Rack did not properly parse certain regular expressions. An attacker could possibly use this issue to bypass network security filters. (CVE-2026-26961)

William T. Nelson discovered that Rack did not handle multipart headers correctly. An attacker could possibly use this issue to cause downstream parsing issues or a denial of service. (CVE-2026-26962)

It was discovered that Rack did not handle the Forwarded header correctly. An attacker could possibly use this issue to manipulate header values. (CVE-2026-32762)

It was discovered that Rack could consume excessive CPU when handling certain Accept-Encoding values. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34230)

Haruki Oyama discovered that certain configurations of Rack could erroneously fail to derive the displayed directory path, and expose the full file system path. An attacker could possibly use this issue to disclose deployment details such as layout and usernames. (CVE-2026-34763)

It was discovered that Rack did not properly handle static file paths. An attacker could possibly use this issue to exfiltrate unintentionally served data. (CVE-2026-34785)

Haruki Oyama discovered that Rack did not apply header rules to certain requests for URL-encoded static paths. An attacker could possibly use this issue to bypass security-relevant response headers. (CVE-2026-34786)

It was discovered that Rack did not limit the number of ranges requested in the Range header. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34826)

It was discovered that Rack could consume excessive CPU when parsing certain multipart parameters. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34827)

It was discovered that Rack could consume unbounded disk space when handling requests without a Content-Length header. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34829)

Mehtab Zafar discovered that Rack directly interpreted the X-Accel-Mapping header as a regular expression without escaping. An attacker could possibly use this issue to exfiltrate arbitrary files from internal locations. (CVE-2026-34830)

It was discovered that Rack did not properly handle messages with Unicode. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34831)

It was discovered that Rack did not properly parse the Host header. An attacker could possibly use this issue to bypass security filters or poison generated links. (CVE-2026-34835)

Record
USN-8989-1
Updated
2026-11-04

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rack
RubyGems
 before 2.2.23
2.2.23
rack
RubyGems
 3.0.0.beta1 up to 3.1.21
3.1.21
rack
RubyGems
 3.2.0 up to 3.2.6
3.2.6
ruby-rack
Debian:12
 before 2.2.22-0+deb12u2, plus listed versions
2.2.13-1~deb12u12.2.20-0+deb12u12.2.22-0+deb12u12.2.6.4-12.2.6.4-1+deb12u12.2.7-12.2.7-1.1
2.2.22-0+deb12u2
ruby-rack
Debian:13
 before 3.1.20-0+deb13u2, plus listed versions
3.1.16-0.13.1.18-13.1.18-1~deb13u13.1.20-0+deb13u1
3.1.20-0+deb13u2
ruby-rack
Debian:14
 before 3.2.6-2, plus listed versions
3.1.16-0.13.1.18-13.1.18-1~deb13u13.2.4-13.2.5-13.2.5-23.2.6-1
3.2.6-2
rack
RubyGems
 before 2.2.23, plus listed versions
0.1.00.2.00.3.00.4.00.9.0
Show 45 moreShow less
0.9.11.0.01.0.11.1.01.1.11.1.1.pre1.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.21.2.31.2.41.2.51.2.61.2.71.2.81.3.01.3.0.beta1.3.0.beta21.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.21.4.31.4.41.4.51.4.61.4.71.5.01.5.0.beta.11.5.0.beta.21.5.1
2.2.23
rack
RubyGems
 3.0.0.beta1 up to 3.1.21, plus listed versions
3.0.03.0.0.rc13.0.13.0.103.0.11
Show 40 moreShow less
3.0.123.0.133.0.143.0.153.0.163.0.173.0.183.0.23.0.33.0.43.0.4.13.0.4.23.0.53.0.63.0.6.13.0.73.0.83.0.93.0.9.13.1.03.1.13.1.103.1.113.1.123.1.133.1.143.1.153.1.163.1.173.1.183.1.193.1.23.1.203.1.33.1.43.1.53.1.63.1.73.1.83.1.9
3.1.21
rack
RubyGems
 3.2.0 up to 3.2.6, plus listed versions
3.2.13.2.23.2.33.2.43.2.5
3.2.6
ruby-rack
Mageia:9
From an advisory covering 12 CVEs
 before 2.2.23-1.mga9
2.2.23-1.mga9
Show 20 moreShow less
Affected packages
PackageAffectedFixed
rmt-server
SUSE:Linux Enterprise Server 16.0
From an advisory covering 10 CVEs
 before 3.1.0-160000.1.1
3.1.0-160000.1.1
rmt-server
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 10 CVEs
 before 3.1.0-160000.1.1
3.1.0-160000.1.1
rmt-server
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 10 CVEs
 before 2.27-150500.3.47.1
2.27-150500.3.47.1
rmt-server
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
From an advisory covering 10 CVEs
 before 2.27-150500.3.47.1
2.27-150500.3.47.1
rmt-server
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 10 CVEs
 before 2.27-150500.3.47.1
2.27-150500.3.47.1
rmt-server
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 10 CVEs
 before 2.27-150500.3.47.1
2.27-150500.3.47.1
rmt-server
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 10 CVEs
 before 2.27-150500.3.47.1
2.27-150500.3.47.1
rmt-server
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 10 CVEs
 before 2.27-150500.3.47.1
2.27-150500.3.47.1
rmt-server
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 10 CVEs
 before 2.27-150500.3.47.1
2.27-150500.3.47.1
rmt-server
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 10 CVEs
 before 2.27-150500.3.47.1
2.27-150500.3.47.1
ruby-rack
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.5.2-11.5.2-1ubuntu0.1~esm11.5.2-3+deb8u3ubuntu1~esm21.5.2-3+deb8u3ubuntu1~esm31.5.2-3+deb8u3ubuntu1~esm4
Show 6 moreShow less
1.5.2-3+deb8u3ubuntu1~esm61.5.2-3+deb8u3ubuntu1~esm71.5.2-3+deb8u3ubuntu1~esm81.5.2-3+deb8u3ubuntu1~esm91.5.2-3+deb8u3ubuntu1~esm101.5.2-3+deb8u3ubuntu1~esm11
 None known
ruby-rack
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.5.2-41.6.4-21.6.4-31.6.4-3ubuntu0.11.6.4-3ubuntu0.2
Show 9 moreShow less
1.6.4-3ubuntu0.2+esm11.6.4-3ubuntu0.2+esm21.6.4-3ubuntu0.2+esm41.6.4-3ubuntu0.2+esm51.6.4-3ubuntu0.2+esm61.6.4-3ubuntu0.2+esm71.6.4-3ubuntu0.2+esm81.6.4-3ubuntu0.2+esm91.6.4-3ubuntu0.2+esm10
 None known
ruby-rack
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.6.4-41.6.4-4ubuntu0.11.6.4-4ubuntu0.21.6.4-4ubuntu0.2+esm11.6.4-4ubuntu0.2+esm2
Show 7 moreShow less
1.6.4-4ubuntu0.2+esm41.6.4-4ubuntu0.2+esm51.6.4-4ubuntu0.2+esm61.6.4-4ubuntu0.2+esm71.6.4-4ubuntu0.2+esm81.6.4-4ubuntu0.2+esm91.6.4-4ubuntu0.2+esm10
 None known
ruby-rack
Ubuntu:Pro:22.04:LTS
 before 2.1.4-5ubuntu1.2+esm3, plus listed versions
2.1.4-32.1.4-42.1.4-52.1.4-5ubuntu12.1.4-5ubuntu1+esm2
Show 9 moreShow less
2.1.4-5ubuntu1+esm32.1.4-5ubuntu1+esm42.1.4-5ubuntu1+esm52.1.4-5ubuntu1.12.1.4-5ubuntu1.1+esm12.1.4-5ubuntu1.1+esm22.1.4-5ubuntu1.22.1.4-5ubuntu1.2+esm12.1.4-5ubuntu1.2+esm2
2.1.4-5ubuntu1.2+esm3
ruby-rack
Ubuntu:24.04:LTS
 before 2.2.7-1ubuntu0.7, plus listed versions
2.2.4-32.2.7-12.2.7-1ubuntu0.12.2.7-1ubuntu0.22.2.7-1ubuntu0.32.2.7-1ubuntu0.42.2.7-1ubuntu0.52.2.7-1ubuntu0.6
2.2.7-1ubuntu0.7
ruby-rack
Ubuntu:25.10
 before 3.1.16-0.1ubuntu0.3, plus listed versions
2.2.7-1.13.1.16-0.13.1.16-0.1ubuntu0.13.1.16-0.1ubuntu0.2
3.1.16-0.1ubuntu0.3
ruby-rack
Ubuntu:26.04:LTS
 before 3.2.4-1ubuntu1.1, plus listed versions
3.1.16-0.13.1.18-13.1.18-1build13.2.4-1ubuntu1
3.2.4-1ubuntu1.1
ruby-rack
Ubuntu:26.04:LTS
From an advisory covering 13 CVEs
 before 3.2.4-1ubuntu1.1, plus listed versions
3.1.16-0.13.1.18-13.1.18-1build13.2.4-1ubuntu1
3.2.4-1ubuntu1.1
rubygem-rack-2.2
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 2.2.23-1.1
2.2.23-1.1
rmt-server
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 3.1.0-160000.1.1
3.1.0-160000.1.1

History

History
RecordedChangedSources
affected
affected, aliases, referencesOSV
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-34829 is a high vulnerability (CVSS 7.5) in Rack, published April 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 31st percentile. Fixed in rack 2.2.23.

References

Show 64 moreShow less
This page doesn't list everything

Left out here: 73 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open