How severe is CVE-2026-34835?

CVE-2026-34835 has a CVSS 3.x base score of 4.8, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2026-34835 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-34835?

CVE-2026-34835 affects Rack. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-34835?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-34835 have an EU (EUVD) identifier?

Yes. CVE-2026-34835 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-18478.

When was CVE-2026-34835 published?

CVE-2026-34835 was published on 2026-04-02 and last updated on 2026-07-24.

CVE-2026-34835

CVE-2026-34835 is a medium-severity vulnerability in Rack with a CVSS 3.x base score of 4.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1286.

Key facts

Severity: Medium (CVSS 3.x base score 4.8)
EPSS exploit prediction: 0% (19th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-18478
Weakness: CWE-1286
Affected product: Rack
Published: 2026-04-02
Last modified: 2026-07-24

Description

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host header using an AUTHORITY regular expression that accepts characters not permitted in RFC-compliant hostnames, including /, ?, #, and @. Because req.host returns the full parsed value, applications that validate hosts using naive prefix or suffix checks can be bypassed. This can lead to host header poisoning in applications that use req.host, req.url, or req.base_url for link generation, redirects, or origin validation. This issue has been patched in versions 3.1.21 and 3.2.6.

Frequently asked questions

What is CVE-2026-34835?: Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host header using an AUTHORITY regular expression that accepts characters not permitted in RFC-compliant hostnames, including /, ?, #, and @. Because req.host returns the full parsed value, applications that validate hosts using naive prefix or suffix checks can be bypassed. This can lead to host header poisoning in applications that use req.host, req.url, or req.base_url for link generation, redirects, or origin validation. This issue has been patched in versions 3.1.21 and 3.2.6.
How severe is CVE-2026-34835?: CVE-2026-34835 has a CVSS 3.x base score of 4.8, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2026-34835 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-34835?: CVE-2026-34835 affects Rack. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-34835?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-34835 have an EU (EUVD) identifier?: Yes. CVE-2026-34835 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-18478.
When was CVE-2026-34835 published?: CVE-2026-34835 was published on 2026-04-02 and last updated on 2026-07-24.

References

https://github.com/rack/rack/security/advisories/GHSA-g2pf-xv49-m2h5

Affected products (1)

cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*

More vulnerabilities in Rack

CVE-2026-34827 — High (CVSS 7.5): Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6,…
CVE-2026-34829 — High (CVSS 7.5): Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only…
CVE-2026-34785 — High (CVSS 7.5): Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines…
CVE-2026-22860 — High (CVSS 7.5): Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory`’s path…
CVE-2025-61919 — High (CVSS 7.5): Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, `Rack::Request#POST` reads…
CVE-2025-61772 — High (CVSS 7.5): Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser`…

All CVEs affecting Rack →

Other CWE-1286 vulnerabilities

CVE-2026-110759 — Critical (CVSS 9.8): Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed…
CVE-2026-87080 — Critical (CVSS 9.1): Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it…
CVE-2026-83728 — High (CVSS 8.8): Improper validation of syntactic correctness of input in Windows Hyper-V allows an authorized attacker to perform…
CVE-2025-41719 — High (CVSS 8.8): A low privileged remote attacker can corrupt the webserver users storage on the device by setting a sequence of…
CVE-2026-6442 — High (CVSS 8.3): Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands…
CVE-2026-102084 — High (CVSS 8.1): An Improper Validation of Syntactic Correctness of Input vulnerability in the VPN daemon of Juniper Networks Junos OS…

Browse all CWE-1286 vulnerabilities →