UBUNTU-CVE-2026-34230: High severity ubuntu/ruby-rack vulnerability
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.selectbestencoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard () entries. Because this method is used by Rack::Deflater to choose a response encoding, an unauthenticated attacker can send a single request with a crafted Accept-Encoding header and cause disproportionate CPU consumption on the compression middleware path. This results in a denial of service condition for applications using Rack::Deflater. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 1.5.2-3+deb8u3ubuntu1~esm11 - Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 1.6.4-3ubuntu0.2+esm10 - Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 1.6.4-4ubuntu0.2+esm10 - Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 2.1.4-5ubuntu1.2+esm3 - Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 2.2.7-1ubuntu0.7 - Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 3.1.16-0.1ubuntu0.3 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 2.2.23 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.1.21 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.2.6
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Applications using Rack::Deflater are affected because it invokes Rack::Utils.select_best_encoding to select a response encoding. Applications that do not use this compression middleware are not identified as affected by the provided information.
What does an attacker need to exploit the issue?
An attacker needs only network access to send a single request containing a crafted Accept-Encoding header with many wildcard (*) entries. No authentication or user interaction is required.
What is the practical impact of a successful attack?
The crafted header causes quadratic-time processing in the compression middleware path, resulting in disproportionate CPU consumption. This can cause a denial-of-service condition.
Which Rack versions contain the fix?
The issue is patched in Rack versions 2.2.23, 3.1.21, and 3.2.6.