UBUNTU-CVE-2026-34835: Medium severity ubuntu/ruby-rack vulnerability
Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host header using an AUTHORITY regular expression that accepts characters not permitted in RFC-compliant hostnames, including /, ?, #, and @. Because req.host returns the full parsed value, applications that validate hosts using naive prefix or suffix checks can be bypassed. This can lead to host header poisoning in applications that use req.host, req.url, or req.baseurl for link generation, redirects, or origin validation. This issue has been patched in versions 3.1.21 and 3.2.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 3.1.16-0.1ubuntu0.3 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.1.21 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.2.6
Event History
Frequently Asked Questions
Which applications are practically exposed to this issue?
Applications using affected Rack versions are exposed when they rely on req.host, req.url, or req.base_url for generated links, redirects, or origin validation, and validate hostnames with naive prefix or suffix checks. The issue can enable host header poisoning in those usage patterns.
What does an attacker need to exploit this?
An attacker needs to send a request with a crafted Host header containing characters accepted by the vulnerable AUTHORITY expression, such as /, ?, #, or @. No privileges or user interaction are required, but exploitation depends on the application’s host-validation and URL-handling logic.
How can I determine whether an application needs remediation?
Check whether it uses Rack from 3.0.0.beta1 through before 3.1.21, or from 3.2.0 through before 3.2.6. Also review application code and dependencies for use of req.host, req.url, or req.base_url in redirects, link generation, or origin checks, especially where host validation is based on prefix or suffix matching.
Which Rack versions contain the fix?
The issue is patched in Rack 3.1.21 and 3.2.6. Upgrade to the applicable fixed release line.