CVE-2026-34826: Rack Denial of Service via Excessive Multipart Byte Ranges
Summary
CVE-2026-34826: Rack's multipart byte range processing allows denial of service via excessive overlapping ranges. Affects rack across 3 version ranges.
< 2.2.23
>= 3.0.0.beta1, < 3.1.21
>= 3.2.0, < 3.2.6
Fixed in 2.2.23, 3.1.21 or 3.2.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rack is a modular Ruby web server interface that provides a common API for web servers and frameworks. It allows developers to build web applications and services efficiently. Rack supports multipart byte range requests, enabling clients to request specific portions of a resource. However, this feature can be exploited, leading to potential denial of service (DoS) attacks.
Vulnerability Detail
The vulnerability arises from the way Rack's Rack::Utils.get_byte_ranges method processes the HTTP Range header. While it checks the total byte coverage against the file size, it does not limit the number of individual byte ranges that can be specified. An attacker can exploit this by sending a request with numerous overlapping byte ranges, such as 'Range: bytes=0-0,0-0,0-0,...', which can lead to excessive CPU, memory, I/O, and bandwidth consumption. This can degrade application performance and availability, especially in file-serving paths that handle multipart byte range responses.
How To Fix
Latest published version: 3.2.7 as of 23 Oct 2026
gem install rack -v 3.2.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.2.232.2.23gem install rack -v 2.2.23 -
>= 3.0.0.beta1, < 3.1.213.1.21gem install rack -v 3.1.21 -
>= 3.2.0, < 3.2.63.2.6gem install rack -v 3.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can reject or normalize multipart byte range requests that contain excessive range counts. Additionally, consider disabling multipart range support if it is not required for your application. Implementing request filtering or header restrictions at the reverse proxy or application boundary can also help limit abusive Range headers.
Conclusion
CVE-2026-34826 is a significant vulnerability in the Rack web server interface that can lead to denial of service through excessive multipart byte range requests. It is crucial to update to the patched versions of Rack to mitigate this risk and ensure the stability of your applications.
See every vulnerability recorded for rack →
FAQ
CVE-2026-34826 is a vulnerability in the Rack web server interface that allows denial of service through excessive multipart byte range requests.
An attacker can exploit this vulnerability to send crafted requests that consume excessive resources, potentially degrading application performance and availability.
Rack versions prior to 2.2.23, 3.1.21, and 3.2.6 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for rack.
