UBUNTU-CVE-2026-34786: Medium severity ubuntu/ruby-rack vulnerability
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static#applicablerules evaluates several headerrules types against the raw URL-encoded PATHINFO, while the underlying file-serving path is decoded before the file is served. As a result, a request for a URL-encoded variant of a static path can serve the same file without the headers that headerrules were intended to apply. In deployments that rely on Rack::Static to attach security-relevant response headers to static content, this can allow an attacker to bypass those headers by requesting an encoded form of the path. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 1.6.4-4ubuntu0.2+esm10 - Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 2.1.4-5ubuntu1.2+esm3 - Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 2.2.7-1ubuntu0.7 - Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 3.1.16-0.1ubuntu0.3 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 2.2.23 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.1.21 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.2.6
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Rack::Static are exposed if they rely on its header_rules to apply security-relevant response headers to static files. The issue affects versions before 2.2.23, 3.1.21, and 3.2.6.
What does an attacker need to do to exploit it?
An attacker can make a network request for a URL-encoded variant of a static file path. No authentication or user interaction is required.
Are all Rack::Static users affected in the same way?
No. The practical impact depends on whether header_rules are used to attach security-relevant headers to static content; encoded paths may receive the file without those intended headers.
How can this be remediated?
Upgrade Rack to version 2.2.23, 3.1.21, or 3.2.6, as appropriate for the deployed release line.