UBUNTU-CVE-2026-34830: High severity ubuntu/ruby-rack vulnerability
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#mapaccelpath interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is not escaped, an attacker who can supply X-Accel-Mapping to the backend can inject regex metacharacters and control the generated X-Accel-Redirect response header. In deployments using Rack::Sendfile with x-accel-redirect, this can allow an attacker to cause nginx to serve unintended files from configured internal locations. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 1.6.4-3ubuntu0.2+esm10 - Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 1.6.4-4ubuntu0.2+esm10 - Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 2.1.4-5ubuntu1.2+esm3 - Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 2.2.7-1ubuntu0.7 - Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 3.1.16-0.1ubuntu0.3 - Upgrade
Upgrade
Rack::Sendfileto a version that resolves this vulnerability.Fixed in 2.2.23 - Upgrade
Upgrade
Rack::Sendfileto a version that resolves this vulnerability.Fixed in 3.1.21 - Upgrade
Upgrade
Rack::Sendfileto a version that resolves this vulnerability.Fixed in 3.2.6
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects deployments that use Rack::Sendfile with x-accel-redirect and nginx internal locations. An attacker must be able to supply the X-Accel-Mapping request header to the backend.
What could an attacker do if exploitation succeeds?
An attacker can inject regular-expression metacharacters into X-Accel-Mapping and influence the generated X-Accel-Redirect response header. This may cause nginx to serve unintended files from configured internal locations.
Which Rack versions contain the fix?
The issue is patched in Rack versions 2.2.23, 3.1.21, and 3.2.6.