CVE-2026-34786: Rack Vulnerability Allows Header Rules Bypass via URL-Encoding
Summary
CVE-2026-34786: Rack:: Static header_rules bypass via URL-encoded paths. Affects rack across 3 version ranges.
< 2.2.23
>= 3.0.0.beta1, < 3.1.21
>= 3.2.0, < 3.2.6
Fixed in 2.2.23, 3.1.21 or 3.2.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rack is a modular Ruby web server interface that serves as a foundation for web applications. It provides a simple interface for handling HTTP requests and responses, allowing developers to build web applications with ease. Rack::Static is a middleware component that serves static files, such as images, stylesheets, and JavaScript, while applying specified response headers for security and caching. However, a vulnerability in Rack::Static allows attackers to bypass security headers by using URL-encoded paths, which can lead to significant security risks.
Vulnerability Detail
The vulnerability arises from the way Rack::Static evaluates header_rules against the raw URL-encoded PATH_INFO. The checks for header_rules are performed on the encoded path, while the underlying file-serving path is decoded before serving the file. This mismatch allows an attacker to request an encoded variant of a static file path, which can serve the same file without the intended security headers. As a result, security measures such as clickjacking defenses or content restrictions may be bypassed, depending on the configured rules and the types of files being served.
How To Fix
Latest published version: 3.2.7 as of 23 Oct 2026
gem install rack -v 3.2.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.2.232.2.23gem install rack -v 2.2.23 -
>= 3.0.0.beta1, < 3.1.213.1.21gem install rack -v 3.1.21 -
>= 3.2.0, < 3.2.63.2.6gem install rack -v 3.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, do not rely solely on Rack::Static header_rules for security-critical headers. Instead, consider setting security headers at the reverse proxy or web server layer to ensure they apply consistently to both encoded and unencoded path forms. Additionally, normalize or reject encoded path variants for static content at the edge, where feasible.
Conclusion
In summary, CVE-2026-34786 is a vulnerability in the Rack library that allows attackers to bypass security headers for static files served by Rack::Static. It is crucial to update to the patched versions of Rack to mitigate this risk and consider implementing additional security measures at the web server layer.
See every vulnerability recorded for rack →
FAQ
CVE-2026-34786 is a vulnerability in the Rack library that allows attackers to bypass security headers by using URL-encoded paths.
If your application relies on Rack::Static for serving static files with security headers, this vulnerability can allow attackers to access those files without the intended protections.
You should update your Rack package to one of the patched versions: 2.2.23, 3.1.21, or 3.2.6.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for rack.
