CVE catalog

CVE-2026-34786

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static#applicable_rules evaluates several header_rules types against the raw URL-encoded PATH_INFO, whil

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.19% · Oct 25, 2026

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static#applicable_rules evaluates several header_rules types against the raw URL-encoded PATH_INFO, while the underlying file-serving path is decoded before the file is served. As a result, a request for a URL-encoded variant of a static path can serve the same file without the headers that header_rules were intended to apply. In deployments that rely on Rack::Static to attach security-relevant response headers to static content, this can allow an attacker to bypass those headers by requesting an encoded form of the path. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-racksid3.2.7-1fixed
Debianruby-rackforky3.2.7-1fixed
Debianruby-racktrixie3.1.20-0+deb13u1vulnerable
Debianruby-racktrixie-security3.1.20-0+deb13u2fixed
Debianruby-rackbookworm2.2.22-0+deb12u1vulnerable
Debianruby-rackbookworm-security2.2.22-0+deb12u2fixed
Cperuby-rackNot reported2.2.7-1ubuntu0.7fixed
Cperuby-rackNot reportedNot reportedvulnerable
CperackNot reported2.2.23fixed
CperackNot reported3.1.21fixed
CperackNot reported3.2.6fixed
Ubunturuby-rackpro2.1.4-3vulnerable
Ubunturuby-rackpro2.1.4-4vulnerable
Ubunturuby-rackpro2.1.4-5vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm2vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm3vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm4vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm5vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.1vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.1+esm1vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.1+esm2vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.2vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.2+esm1vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.2+esm2vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.2+esm3fixed
Ubunturuby-rack24.042.2.4-3vulnerable
Ubunturuby-rack24.042.2.7-1vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.1vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.2vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.3vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.4vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.5vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.6vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.7fixed
Ubunturuby-rack25.102.2.7-1.1vulnerable
Ubunturuby-rack25.103.1.16-0.1vulnerable
Ubunturuby-rack25.103.1.16-0.1ubuntu0.1vulnerable
Ubunturuby-rack25.103.1.16-0.1ubuntu0.2vulnerable
Ubunturuby-rack25.103.1.16-0.1ubuntu0.3fixed
Ubunturuby-rack26.043.1.16-0.1vulnerable
Ubunturuby-rack26.043.1.18-1vulnerable
Ubunturuby-rack26.043.1.18-1build1vulnerable
Ubunturuby-rack26.043.2.4-1ubuntu1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-racksourcesid3.2.6-2not yet assignedNot reportedNot reported
Debianruby-racksourceforky3.2.6-2not yet assignedNot reportedNot reported
Debianruby-racksourcetrixie3.1.20-0+deb13u2not yet assignedNot reportedNot reported
Debianruby-racksourcebookworm2.2.22-0+deb12u2not yet assignedNot reportedNot reported
Cperuby-rackcpeNot reported2.2.7-1ubuntu0.7Not reportedNot reportedNot reported
CperackcpeNot reported2.2.23Not reportedNot reportedNot reported
CperackcpeNot reported3.1.21Not reportedNot reportedNot reported
CperackcpeNot reported3.2.6Not reportedNot reportedNot reported
Ubunturuby-rackdebpro2.1.4-5ubuntu1.2+esm3Not reportedUBUNTU-CVE-2026-34786Not reported
Ubunturuby-rackdeb24.042.2.7-1ubuntu0.7Not reportedUBUNTU-CVE-2026-34786Not reported
Ubunturuby-rackdeb25.103.1.16-0.1ubuntu0.3Not reportedUBUNTU-CVE-2026-34786Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ruby-rack]Affected
    Details (4)

    • 2.2.22-0+deb12u1 · all · bookworm

      Affected · Fixed: 2.2.22-0+deb12u2

      nvd · ruby-rack · debian · bookworm; nvd · ruby-rack · debian · 12

    • 2.2.22-0+deb12u1 · all · bookworm

      Affected · Fixed: 2.2.22-0+deb12u2

      nvd · ruby-rack · debian · bookworm; nvd · ruby-rack · debian · 12

    • 2.2.22-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 2.2.22-0+deb12u2

      nvd · ruby-rack · debian · bookworm; nvd · ruby-rack · debian · 12

    • 2.2.22-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 2.2.22-0+deb12u2

      nvd · ruby-rack · debian · bookworm; nvd · ruby-rack · debian · 12

[Debian 13 (Trixie)]

  • [ruby-rack]Affected
    Details (5)

    • 3.1.20-0+deb13u1 · all · trixie

      Affected · Fixed: 3.1.20-0+deb13u2

      nvd · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie

      Affected · Fixed: 3.1.20-0+deb13u2

      nvd · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie-security

      Affected · Fixed: 3.1.20-0+deb13u2

      nvd · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie-security · Historical version

      Affected · Fixed: 3.1.20-0+deb13u2

      nvd · ruby-rack · debian · 13

    • 3.1.20-0+deb13u2 · all · trixie-security

      Fixed · Fixed: 3.1.20-0+deb13u2

      nvd · ruby-rack · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]