TI-2026-27070 Aliases CVE-2026-34826 GHSA-x8cg-fq8g-mxfx

Rack: Unbounded Range Count in get_byte_ranges Enables DoS

LOW 39CWE-400Published 2026-04-02 · Updated 2026-04-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.get_byte_ranges parses the HTTP Range header without limiting the number of individual byte ranges. Although the existing fix for CVE-2024-26141 rejects ranges whose total byte coverage exceeds the file size, it does not restrict the count of ranges. An attacker can supply many small overlapping ranges such as 0-0,0-0,0-0,... to trigger disproportionate CPU, memory, I/O, and bandwidth consumption per request. This results in a denial of service condition in Rack file-serving paths that process multipart byte range responses. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00395 33rd percentileScored 2026-11-07

Fix Partial rack (rack): 2.2.23, 3.1.21, 3.2.6rack (RubyGems): 2.2.23, 3.1.21, 3.2.6Red Hat: 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
rack	rack	before 2.2.23; 3.0.0.beta1 to before 3.1.21; 3.2.0 to before 3.2.6	2.2.23, 3.1.21, 3.2.6	Patch available	CNA
—	rack (RubyGems)	before 2.2.23	2.2.23	Patch available	GHSA-x8cg-fq8g-mxfx
—	rack (RubyGems)	3.0.0.beta1 to before 3.1.21	3.1.21	Patch available	GHSA-x8cg-fq8g-mxfx
—	rack (RubyGems)	3.2.0 to before 3.2.6	3.2.6	Patch available	GHSA-x8cg-fq8g-mxfx

rack Vendorrack Affected before 2.2.23; 3.0.0.beta1 to before 3.1.21; 3.2.0 to before 3.2.6 Fixed in 2.2.23, 3.1.21, 3.2.6 Patch available CNA
rack (RubyGems) Vendor— Affected before 2.2.23 Fixed in 2.2.23 Patch available GHSA-x8cg-fq8g-mxfx
rack (RubyGems) Vendor— Affected 3.0.0.beta1 to before 3.1.21 Fixed in 3.1.21 Patch available GHSA-x8cg-fq8g-mxfx
rack (RubyGems) Vendor— Affected 3.2.0 to before 3.2.6 Fixed in 3.2.6 Patch available GHSA-x8cg-fq8g-mxfx

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:rack:rack::::::ruby::*	before 2.2.23; 3.0.0 to before 3.1.21; 3.2.0 to before 3.2.6	Vulnerable	rack

cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:* Versions before 2.2.23; 3.0.0 to before 3.1.21; 3.2.0 to before 3.2.6 Vulnerable ·rack

Remediation

Fix · CNA rack (rack) Fixed in 2.2.23, 3.1.21, 3.2.6
Fix · GHSA-x8cg-fq8g-mxfx rack (RubyGems) Fixed in 2.2.23 Advisory →
Fix · GHSA-x8cg-fq8g-mxfx rack (RubyGems) Fixed in 3.1.21 Advisory →
Fix · GHSA-x8cg-fq8g-mxfx rack (RubyGems) Fixed in 3.2.6 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Logging Subsystem for Red Hat OpenShift	Affected	No fix yet: Fix deferred
Red Hat 3scale API Management Platform 2	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-34826
2026-10-03 Alias added: GHSA-x8cg-fq8g-mxfx

References

Advisory 2

Other 2

TI-2024-16580 Rack ReDos in content type parsing (2nd degree polynomial) CVSS 3.1HIGH 7.5
TI-2024-17236 Possible Denial of Service Vulnerability in Rack Header Parsing CVSS 3.1HIGH 7.5
TI-2024-17231 Possible DoS Vulnerability with Range Header in Rack CVSS 3.1HIGH 7.5
TI-2023-12254 Uncontrolled resource consumption in https://github.com/rack/rack CVSS 3.1HIGH 7.5
TI-2025-38165 Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) CVSS 3.1HIGH 7.5
TI-2025-38163 Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) CVSS 3.1HIGH 7.5

See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences