CVE-2026-34826

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.get_byte_ranges parses the HTTP Range header without limiting the number of individual byte ranges. Although the existing fix for CVE-2024-26141 rejects ranges whose total byte coverage exceeds the file size, it does not restrict the count of ranges. An attacker can supply many small overlapping ranges such as 0-0,0-0,0-0,... to trigger disproportionate CPU, memory, I/O, and bandwidth consumption per request. This results in a denial of service condition in Rack file-serving paths that process multipart byte range responses. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/rack/rack/security/advisories/GHSA-x8cg-fq8g-mxfx	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:rack:rack::::::ruby::*
	cpe:2.3:a:rack:rack::::::ruby::*
	cpe:2.3:a:rack:rack::::::ruby::*

History

No history.

Information

Published : 2026-04-02 17:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-34826

Mitre link : CVE-2026-34826

CVE.ORG link : CVE-2026-34826

JSON object : View

Products Affected

rack

rack

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-34826", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34826", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-02T18:42:34.710335Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "rack", "product": "rack", "versions": [{"status": "affected", "version": "< 2.2.23"}, {"status": "affected", "version": ">= 3.0.0.beta1, < 3.1.21"}, {"status": "affected", "version": ">= 3.2.0, < 3.2.6"}]}]}], "published": "2026-04-02T17:16:25.880", "references": [{"url": "https://github.com/rack/rack/security/advisories/GHSA-x8cg-fq8g-mxfx", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.get_byte_ranges parses the HTTP Range header without limiting the number of individual byte ranges. Although the existing fix for CVE-2024-26141 rejects ranges whose total byte coverage exceeds the file size, it does not restrict the count of ranges. An attacker can supply many small overlapping ranges such as 0-0,0-0,0-0,... to trigger disproportionate CPU, memory, I/O, and bandwidth consumption per request. This results in a denial of service condition in Rack file-serving paths that process multipart byte range responses. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6."}, {"lang": "es", "value": "Rack es una interfaz modular de servidor web Ruby. Antes de las versiones 2.2.23, 3.1.21 y 3.2.6, Rack::Utils.get_byte_ranges analiza el encabezado HTTP Range sin limitar el n\u00famero de rangos de bytes individuales. Aunque la soluci\u00f3n existente para CVE-2024-26141 rechaza rangos cuya cobertura total de bytes excede el tama\u00f1o del archivo, no restringe el recuento de rangos. Un atacante puede proporcionar muchos rangos peque\u00f1os superpuestos como 0-0,0-0,0-0,... para desencadenar un consumo desproporcionado de CPU, memoria, E/S y ancho de banda por solicitud. Esto resulta en una condici\u00f3n de denegaci\u00f3n de servicio en las rutas de servicio de archivos de Rack que procesan respuestas de rango de bytes multipartes. Este problema ha sido parcheado en las versiones 2.2.23, 3.1.21 y 3.2.6."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "AD5DE7DE-3A8B-4064-A7D5-1E117A101E81", "versionEndExcluding": "2.2.23"}, {"criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "6948AAA6-873D-46BA-AA22-4C81138128E1", "versionEndExcluding": "3.1.21", "versionStartIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "3FB592AD-E826-49BE-AC6D-E5F55FDCC96E", "versionEndExcluding": "3.2.6", "versionStartIncluding": "3.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}