CVE-2026-34835: Rack Vulnerability Allows Host Allowlist Bypass via Invalid Characters
Summary
CVE-2026-34835: Rack::Request accepts invalid Host characters, enabling host allowlist bypass. Affects rack across 2 version ranges.
>= 3.0.0.beta1, < 3.1.21
>= 3.2.0, < 3.2.6
Fixed in 3.1.21 or 3.2.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rack is a modular Ruby web server interface that provides a minimal, consistent interface between web servers and Ruby frameworks. It is widely used in Ruby applications to handle HTTP requests and responses. The package is designed to be flexible and lightweight, allowing developers to build web applications efficiently. However, it has been found to accept invalid characters in the Host header, which can lead to security vulnerabilities.
Vulnerability Detail
The vulnerability in Rack arises from its handling of the Host header, where it uses a regular expression that permits characters not allowed in RFC-compliant hostnames, such as '/', '?', '#', and '@'. This flaw can enable attackers to bypass host allowlists by crafting malicious Host headers. For instance, a naive check like 'req.host.start_with?("myapp.com")' could be bypassed with 'Host: myapp.com@evil.com'. This can lead to host header poisoning, allowing attackers to manipulate generated links, redirects, or origin validation, potentially resulting in severe security issues like password reset link poisoning.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.0.0.beta1, < 3.1.213.1.21gem install rack -v 3.1.21 -
>= 3.2.0, < 3.2.63.2.6gem install rack -v 3.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, enforce strict Host header validation at your reverse proxy or load balancer. Avoid using naive string checks for host allowlisting. Instead, implement exact host allowlists or subdomain boundary checks after validating the host's syntax.
Conclusion
The vulnerability CVE-2026-34835 in the Rack package poses a significant risk by allowing host allowlist bypass through invalid characters in the Host header. It is crucial to update to the patched versions of Rack to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for rack →
FAQ
CVE-2026-34835 is a vulnerability in the Rack package that allows attackers to bypass host allowlists by using invalid characters in the Host header.
If your application relies on Rack for handling HTTP requests and performs naive host validation, it may be susceptible to host header poisoning attacks.
Exploiting this vulnerability can lead to security issues such as link poisoning, unauthorized access, and manipulation of redirects.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement strict validation for the Host header at your reverse proxy or load balancer as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for rack.
