CVE-2026-34831: Rack Content-Length Mismatch in Error Responses
Summary
CVE-2026-34831: Rack has Content-Length mismatch in Rack::Files error responses. Affects rack across 3 version ranges.
< 2.2.23
>= 3.0.0.beta1, < 3.1.21
>= 3.2.0, < 3.2.6
Fixed in 2.2.23, 3.1.21 or 3.2.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Rack is a modular Ruby web server interface that provides a minimal, standardized API for web servers to communicate with web applications. It is widely used in Ruby applications to handle HTTP requests and responses. Rack::Files is a component of Rack that serves static files. This component is crucial for delivering assets efficiently but is vulnerable to a specific issue that can lead to incorrect HTTP response framing.
Vulnerability Detail
The vulnerability arises from the method Rack::Files#fail, which sets the Content-Length response header using String#size instead of String#bytesize. This discrepancy occurs when the response body includes multibyte UTF-8 characters, leading to a Content-Length value that is smaller than the actual byte size sent over the network. An attacker can exploit this by requesting non-existent paths with percent-encoded UTF-8 characters, resulting in malformed HTTP responses that can cause response desynchronization in certain deployment scenarios.
How To Fix
Latest published version: 3.2.7 as of 23 Oct 2026
gem install rack -v 3.2.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.2.232.2.23gem install rack -v 2.2.23 -
>= 3.0.0.beta1, < 3.1.213.1.21gem install rack -v 3.1.21 -
>= 3.2.0, < 3.2.63.2.6gem install rack -v 3.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating is not immediately feasible, consider avoiding direct exposure of Rack::Files to untrusted traffic. Additionally, you can place Rack behind a proxy or server that normalizes or rejects malformed backend responses. Prefer closing backend connections on error paths to mitigate response framing anomalies.
Conclusion
The CVE-2026-34831 vulnerability in Rack's handling of Content-Length in error responses poses a risk of malformed HTTP responses, particularly when dealing with multibyte UTF-8 characters. It is crucial to update to the patched versions of Rack to mitigate this issue and ensure proper response framing.
See every vulnerability recorded for rack →
FAQ
The vulnerability is a Content-Length mismatch in error responses generated by Rack::Files, which can lead to malformed HTTP responses.
An attacker can exploit this vulnerability by requesting non-existent paths that contain multibyte UTF-8 characters, causing incorrect Content-Length values.
The impacts include response desynchronization, parsing inconsistencies in intermediaries, and potential protocol errors in strict components.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for rack.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
