CVE catalog

CVE-2026-34835

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host header using an AUTHORITY regular expression that acce

[CVE catalog]

Severity
Medium · CVSS 4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.19% · Oct 25, 2026

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host header using an AUTHORITY regular expression that accepts characters not permitted in RFC-compliant hostnames, including /, ?, #, and @. Because req.host returns the full parsed value, applications that validate hosts using naive prefix or suffix checks can be bypassed. This can lead to host header poisoning in applications that use req.host, req.url, or req.base_url for link generation, redirects, or origin validation. This issue has been patched in versions 3.1.21 and 3.2.6.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-racksid3.2.7-1fixed
Debianruby-rackforky3.2.7-1fixed
Debianruby-racktrixie3.1.20-0+deb13u1vulnerable
Debianruby-racktrixie-security3.1.20-0+deb13u2fixed
Debianruby-rackbookworm2.2.22-0+deb12u1not affected
Debianruby-rackbookworm-security2.2.22-0+deb12u2not affected
Cperuby-rackNot reported2.2.7-1ubuntu0.7fixed
Cperuby-rackNot reportedNot reportedvulnerable
CperackNot reported3.1.21fixed
CperackNot reported3.2.6fixed
Ubunturuby-rack25.102.2.7-1.1vulnerable
Ubunturuby-rack25.103.1.16-0.1vulnerable
Ubunturuby-rack25.103.1.16-0.1ubuntu0.1vulnerable
Ubunturuby-rack25.103.1.16-0.1ubuntu0.2vulnerable
Ubunturuby-rack25.103.1.16-0.1ubuntu0.3fixed
Ubunturuby-rack26.043.1.16-0.1vulnerable
Ubunturuby-rack26.043.1.18-1vulnerable
Ubunturuby-rack26.043.1.18-1build1vulnerable
Ubunturuby-rack26.043.2.4-1ubuntu1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-racksourcesid3.2.6-2not yet assignedNot reportedNot reported
Debianruby-racksourceforky3.2.6-2not yet assignedNot reportedNot reported
Debianruby-racksourcetrixie3.1.20-0+deb13u2not yet assignedNot reportedNot reported
Debianruby-racksourcebookwormNot affectedunimportantNot reportedNot reported
Cperuby-rackcpeNot reported2.2.7-1ubuntu0.7Not reportedNot reportedNot reported
CperackcpeNot reported3.1.21Not reportedNot reportedNot reported
CperackcpeNot reported3.2.6Not reportedNot reportedNot reported
Ubunturuby-rackdeb25.103.1.16-0.1ubuntu0.3Not reportedUBUNTU-CVE-2026-34835Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [ruby-rack]Affected
    Details (5)

    • 3.1.20-0+deb13u1 · all · trixie

      Affected · Fixed: 3.1.20-0+deb13u2

      nvd · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie

      Affected · Fixed: 3.1.20-0+deb13u2

      nvd · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie-security

      Affected · Fixed: 3.1.20-0+deb13u2

      nvd · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie-security · Historical version

      Affected · Fixed: 3.1.20-0+deb13u2

      nvd · ruby-rack · debian · 13

    • 3.1.20-0+deb13u2 · all · trixie-security

      Fixed · Fixed: 3.1.20-0+deb13u2

      nvd · ruby-rack · debian · 13

[Debian 12 (Bookworm)]

  • [ruby-rack]Not affected
    Details (4)

    • 2.2.22-0+deb12u1 · all · bookworm

      Not affected

      nvd · ruby-rack · debian · bookworm

    • 2.2.22-0+deb12u1 · all · bookworm

      Not affected

      nvd · ruby-rack · debian · bookworm

    • 2.2.22-0+deb12u2 · all · bookworm-security

      Not affected

      nvd · ruby-rack · debian · bookworm

    • 2.2.22-0+deb12u2 · all · bookworm-security

      Not affected

      nvd · ruby-rack · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]