CVE-2026-34830

Summary

Rack::Sendfile#map_accel_path interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is not escaped, an attacker who can supply X-Accel-Mapping to the backend can inject regex metacharacters and control the generated X-Accel-Redirect response header.

In deployments using Rack::Sendfile with x-accel-redirect, this can allow an attacker to cause nginx to serve unintended files from configured internal locations.

Details

Rack::Sendfile#map_accel_path processes header-supplied mappings using logic equivalent to:

mapping.split(',').map(&:strip).each do |m|
  internal, external = m.split('=', 2).map(&:strip)
  new_path = path.sub(/\A#{internal}/i, external)
  return new_path unless path == new_path
end

Here, internal comes from the HTTP_X_ACCEL_MAPPING request header and is inserted directly into a regular expression without escaping. This gives the header value regex semantics rather than treating it as a literal prefix.

As a result, an attacker can supply metacharacters such as .* or capture groups to alter how the path substitution is performed. For example, a mapping such as:

X-Accel-Mapping: .*=/protected/secret.txt

causes the entire source path to match and rewrites the redirect target to a clean attacker-chosen internal path.

This differs from the documented behavior of the header-based mapping path, which is described as a simple substitution. While application-supplied mappings may intentionally support regular expressions, header-supplied mappings should be treated as literal path prefixes.

The issue is only exploitable when untrusted X-Accel-Mapping headers can reach Rack. One realistic case is a reverse proxy configuration that intends to set X-Accel-Mapping itself, but fails to do so on some routes, allowing a client-supplied header to pass through unchanged.

Impact

Applications using Rack::Sendfile with x-accel-redirect may be affected if the backend accepts attacker-controlled X-Accel-Mapping headers.

In affected deployments, an attacker may be able to control the X-Accel-Redirect response header and cause nginx to serve files from internal locations that were not intended to be reachable through the application. This can lead to unauthorized file disclosure.

The practical impact depends on deployment architecture. If the proxy always strips or overwrites X-Accel-Mapping, or if the application uses explicit configured mappings instead of the request header, exploitability may be eliminated.

Mitigation

• Update to a patched version of Rack that treats header-supplied X-Accel-Mapping values as literal strings rather than regular expressions.
• Strip or overwrite inbound X-Accel-Mapping headers at the reverse proxy so client-supplied values never reach Rack.
• Prefer explicit application-configured sendfile mappings instead of relying on request-header mappings.
• Review proxy sub-locations and inherited header settings to ensure X-Accel-Mapping is consistently set on all backend routes.

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is not escaped, an attacker who can supply X-Accel-Mapping to the backend can inject regex metacharacters and control the generated X-Accel-Redirect response header. In deployments using Rack::Sendfile with x-accel-redirect, this can allow an attacker to cause nginx to serve unintended files from configured internal locations. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

CVE-2026-26961 Greedy multipart boundary parsing can cause parser differentials and WAF bypass. Forwarded header semicolon injection enables Host and Scheme spoofing. CVE-2026-34230 Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header. CVE-2026-34763 Root directory disclosure via unescaped regex interpolation in Rack::Directory. CVE-2026-34785 Rack::Static prefix matching can expose unintended files under the static root. CVE-2026-34786 Rack::Static header_rules bypass via URL-encoded path mismatch. CVE-2026-34826 Multipart byte range processing allows denial of service via excessive overlapping ranges. CVE-2026-34827 Multipart header parsing allows denial of service via escape-heavy quoted parameters. CVE-2026-34829 Multipart parsing without Content-Length header allows unbounded chunked file uploads. CVE-2026-34830 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect. CVE-2026-34831 Content-Length mismatch in Rack::Files error responses. CVE-2026-34835 Rack::Request accepts invalid Host characters, enabling host allowlist bypass.

These are all security issues fixed in the ruby4.0-rubygem-rack-2.2-2.2.23-1.1 package on the GA media of openSUSE Tumbleweed.

This update for rmt-server fixes the following issues:

Update to version 3.1 (bsc#1274715).

Security issues fixed:

• CVE-2026-26961: rack: greedy multipart boundary parsing can lead to parser differentials and WAF bypass (bsc#1261398).
• CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to downstream header injection and response splitting(bsc#1261471).
• CVE-2026-34763: rack: unescaped regex interpolation of configured root path can lead to root directory disclosure (bsc#1261406).
• CVE-2026-34230: rack: crafted Accept-Encoding headers can cause a denial of service (bsc#1261388).
• CVE-2026-34785: rack: prefix matching logic can lead to the exposure of unintended files under the static root (bsc#1261417).
• CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
• CVE-2026-34826: rack: missing individual byte range limit checks when parsing HTTP Range headers can lead to excessive resource consumption and a denial of service (bsc#1261436).
• CVE-2026-34829: rack: multipart parsing without Content-Length header can lead to unbounded chunked file uploads and a denial of service (bsc#1261447).
• CVE-2026-34230: rack: quadratic complexity when processing of wildcard Accept-Encoding headers can lead to a denial of service (bsc#1261388).
• CVE-2026-34830: rack: improper sanitization of the X-Accel-Mapping request header can lead to the exposure of unintended files via X-Accel-Redirect (bsc#1261458).
• CVE-2026-34831: rack: Content-Length header and body byte size mismatch when creating error responses can lead to incorrect HTTP response framing (bsc#1261466).

Other updates and bugfixes:

• Version 3.1:
  • Remove all errors and warnigs due to new Ruby and Ruby on Rails versions
• Version 2.28:
  • Set arch to unknown for Rancher based products (jsc#SCC-759)
  • Fix purge for large amount of systems (bsc#1262706)
  • Change data type to MEDIUMTEXT in profiles table (bsc#1268305)
  • Remove proxy_byos column
  • Fix race condition when no system matches (bsc#1268301)
  • Fix race condition for PAYG (bsc#1268149)
  • Fix race condition to update a system (bsc#1268303)
• Version 2.27:
  • Fix ReDoS vulnerability in Addressable
  • Fixes out-of-bounds read vulnerability in rdiscount

This update for rmt-server fixes the following issues:

Update to version 2.27.

Security issues fixed:

• CVE-2026-26961: rack: greedy multipart boundary parsing can lead to parser differentials and WAF bypass (bsc#1261398).
• CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to downstream header injection and response splitting(bsc#1261471).
• CVE-2026-34763: rack: unescaped regex interpolation of configured root path can lead to root directory disclosure (bsc#1261406).
• CVE-2026-34785: rack: prefix matching logic can lead to the exposure of unintended files under the static root (bsc#1261417).
• CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
• CVE-2026-34826: rack: missing individual byte range limit checks when parsing HTTP Range headers can lead to excessive resource consumption and a denial of service (bsc#1261436).
• CVE-2026-34829: rack: multipart parsing without Content-Length header can lead to unbounded chunked file uploads and a denial of service (bsc#1261447).
• CVE-2026-34230: rack: quadratic complexity when processing of wildcard Accept-Encoding headers can lead to a denial of service (bsc#1261388).
• CVE-2026-34830: rack: improper sanitization of the X-Accel-Mapping request header can lead to the exposure of unintended files via X-Accel-Redirect (bsc#1261458).
• CVE-2026-34831: rack: Content-Length header and body byte size mismatch when creating error responses can lead to incorrect HTTP response framing (bsc#1261466).

Other updates and bugfixes:

• Fix ReDoS in Addressable.
• Fix out-of-bounds read in rdiscount.

This update for rmt-server fixes the following issues

• CVE-2026-26961: rack: mismatch in header handling can allow to smuggle multipart content (bsc#1261398).
• CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to header injection or response splitting (bsc#1261471).
• CVE-2026-34230: rack: crafted Accept-Encoding header can cause a denial of service (bsc#1261388).
• CVE-2026-34763: rack: failing of the prefix stripping can lead to information disclosure (bsc#1261406).
• CVE-2026-34785: rack: prefix matching can expose unintended files under the static root (bsc#1261417).
• CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
• CVE-2026-34826: rack: multipart byte range processing can allow denial of service (bsc#1261436).
• CVE-2026-34829: rack: multipart parsing without Content-Length header allows unbounded chunked file uploads (bsc#1261447).
• CVE-2026-34830: rack: crafted X-Accel-Mappingheaders can lead to regex injection (bsc#1261458).
• CVE-2026-34831: rack: Content-Length mismatch can lead to incorrectly framed error responses (bsc#1261466).

Other fixes:

• Update to version 2.27

This update for rmt-server fixes the following issues:

Update to version 3.1 (bsc#1274715).

Security issues fixed:

• CVE-2026-26961: rack: greedy multipart boundary parsing can lead to parser differentials and WAF bypass (bsc#1261398).
• CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to downstream header injection and response splitting(bsc#1261471).
• CVE-2026-34763: rack: unescaped regex interpolation of configured root path can lead to root directory disclosure (bsc#1261406).
• CVE-2026-34230: rack: crafted Accept-Encoding headers can cause a denial of service (bsc#1261388).
• CVE-2026-34785: rack: prefix matching logic can lead to the exposure of unintended files under the static root (bsc#1261417).
• CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
• CVE-2026-34826: rack: missing individual byte range limit checks when parsing HTTP Range headers can lead to excessive resource consumption and a denial of service (bsc#1261436).
• CVE-2026-34829: rack: multipart parsing without Content-Length header can lead to unbounded chunked file uploads and a denial of service (bsc#1261447).
• CVE-2026-34230: rack: quadratic complexity when processing of wildcard Accept-Encoding headers can lead to a denial of service (bsc#1261388).
• CVE-2026-34830: rack: improper sanitization of the X-Accel-Mapping request header can lead to the exposure of unintended files via X-Accel-Redirect (bsc#1261458).
• CVE-2026-34831: rack: Content-Length header and body byte size mismatch when creating error responses can lead to incorrect HTTP response framing (bsc#1261466).

Other updates and bugfixes:

• Version 3.1:
  • Remove all errors and warnigs due to new Ruby and Ruby on Rails versions
• Version 2.28:
  • Set arch to unknown for Rancher based products (jsc#SCC-759)
  • Fix purge for large amount of systems (bsc#1262706)
  • Change data type to MEDIUMTEXT in profiles table (bsc#1268305)
  • Remove proxy_byos column
  • Fix race condition when no system matches (bsc#1268301)
  • Fix race condition for PAYG (bsc#1268149)
  • Fix race condition to update a system (bsc#1268303)
• Version 2.27:
  • Fix ReDoS vulnerability in Addressable
  • Fixes out-of-bounds read vulnerability in rdiscount

This update for rmt-server fixes the following issues

• CVE-2026-26961: rack: mismatch in header handling can allow to smuggle multipart content (bsc#1261398).
• CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to header injection or response splitting (bsc#1261471).
• CVE-2026-34230: rack: crafted Accept-Encoding header can cause a denial of service (bsc#1261388).
• CVE-2026-34763: rack: failing of the prefix stripping can lead to information disclosure (bsc#1261406).
• CVE-2026-34785: rack: prefix matching can expose unintended files under the static root (bsc#1261417).
• CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
• CVE-2026-34826: rack: multipart byte range processing can allow denial of service (bsc#1261436).
• CVE-2026-34829: rack: multipart parsing without Content-Length header allows unbounded chunked file uploads (bsc#1261447).
• CVE-2026-34830: rack: crafted X-Accel-Mappingheaders can lead to regex injection (bsc#1261458).
• CVE-2026-34831: rack: Content-Length mismatch can lead to incorrectly framed error responses (bsc#1261466).

Changes for rmt-server:

• Updated to version 2.27

Andrew Lacambra discovered that Rack did not properly parse certain regular expressions. An attacker could possibly use this issue to bypass network security filters. (CVE-2026-26961)

William T. Nelson discovered that Rack did not handle multipart headers correctly. An attacker could possibly use this issue to cause downstream parsing issues or a denial of service. (CVE-2026-26962)

It was discovered that Rack did not handle the Forwarded header correctly. An attacker could possibly use this issue to manipulate header values. (CVE-2026-32762)

It was discovered that Rack could consume excessive CPU when handling certain Accept-Encoding values. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34230)

Haruki Oyama discovered that certain configurations of Rack could erroneously fail to derive the displayed directory path, and expose the full file system path. An attacker could possibly use this issue to disclose deployment details such as layout and usernames. (CVE-2026-34763)

It was discovered that Rack did not properly handle static file paths. An attacker could possibly use this issue to exfiltrate unintentionally served data. (CVE-2026-34785)

Haruki Oyama discovered that Rack did not apply header rules to certain requests for URL-encoded static paths. An attacker could possibly use this issue to bypass security-relevant response headers. (CVE-2026-34786)

It was discovered that Rack did not limit the number of ranges requested in the Range header. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34826)

It was discovered that Rack could consume excessive CPU when parsing certain multipart parameters. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34827)

It was discovered that Rack could consume unbounded disk space when handling requests without a Content-Length header. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34829)

Mehtab Zafar discovered that Rack directly interpreted the X-Accel-Mapping header as a regular expression without escaping. An attacker could possibly use this issue to exfiltrate arbitrary files from internal locations. (CVE-2026-34830)

It was discovered that Rack did not properly handle messages with Unicode. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34831)

It was discovered that Rack did not properly parse the Host header. An attacker could possibly use this issue to bypass security filters or poison generated links. (CVE-2026-34835)