TI-2026-27075 Aliases CVE-2026-34831 GHSA-q2ww-5357-x388

Rack: Content-Length mismatch in Rack::Files error responses

LOW 28CWE-130Published 2026-04-02 · Updated 2026-04-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: Partial Red Hat: 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Files#fail sets the Content-Length response header using String#size instead of String#bytesize. When the response body contains multibyte UTF-8 characters, the declared Content-Length is smaller than the number of bytes actually sent on the wire. Because Rack::Files reflects the requested path in 404 responses, an attacker can trigger this mismatch by requesting a non-existent path containing percent-encoded UTF-8 characters. This results in incorrect HTTP response framing and may cause response desynchronization in deployments that rely on the incorrect Content-Length value. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00152 4th percentileScored 2026-11-07

Fix Partial rack (rack): 2.2.23, 3.1.21, 3.2.6rack (RubyGems): 2.2.23, 3.1.21, 3.2.6Red Hat: 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
rack	rack	before 2.2.23; 3.0.0.beta1 to before 3.1.21; 3.2.0 to before 3.2.6	2.2.23, 3.1.21, 3.2.6	Patch available	CNA
—	rack (RubyGems)	before 2.2.23	2.2.23	Patch available	GHSA-q2ww-5357-x388
—	rack (RubyGems)	3.0.0.beta1 to before 3.1.21	3.1.21	Patch available	GHSA-q2ww-5357-x388
—	rack (RubyGems)	3.2.0 to before 3.2.6	3.2.6	Patch available	GHSA-q2ww-5357-x388

rack Vendorrack Affected before 2.2.23; 3.0.0.beta1 to before 3.1.21; 3.2.0 to before 3.2.6 Fixed in 2.2.23, 3.1.21, 3.2.6 Patch available CNA
rack (RubyGems) Vendor— Affected before 2.2.23 Fixed in 2.2.23 Patch available GHSA-q2ww-5357-x388
rack (RubyGems) Vendor— Affected 3.0.0.beta1 to before 3.1.21 Fixed in 3.1.21 Patch available GHSA-q2ww-5357-x388
rack (RubyGems) Vendor— Affected 3.2.0 to before 3.2.6 Fixed in 3.2.6 Patch available GHSA-q2ww-5357-x388

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:rack:rack::::::ruby::*	before 2.2.23; 3.0.0 to before 3.1.21; 3.2.0 to before 3.2.6	Vulnerable	rack

cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:* Versions before 2.2.23; 3.0.0 to before 3.1.21; 3.2.0 to before 3.2.6 Vulnerable ·rack

Remediation

Fix · CNA rack (rack) Fixed in 2.2.23, 3.1.21, 3.2.6
Fix · GHSA-q2ww-5357-x388 rack (RubyGems) Fixed in 2.2.23 Advisory →
Fix · GHSA-q2ww-5357-x388 rack (RubyGems) Fixed in 3.1.21 Advisory →
Fix · GHSA-q2ww-5357-x388 rack (RubyGems) Fixed in 3.2.6 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Logging Subsystem for Red Hat OpenShift	Affected	No fix yet: Fix deferred
Red Hat 3scale API Management Platform 2	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 10	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 7	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-34831
2026-10-03 Alias added: GHSA-q2ww-5357-x388

References

Advisory 2

Other 2

TI-2024-16580 Rack ReDos in content type parsing (2nd degree polynomial) CVSS 3.1HIGH 7.5
TI-2024-17236 Possible Denial of Service Vulnerability in Rack Header Parsing CVSS 3.1HIGH 7.5
TI-2024-17231 Possible DoS Vulnerability with Range Header in Rack CVSS 3.1HIGH 7.5
TI-2023-12254 Uncontrolled resource consumption in https://github.com/rack/rack CVSS 3.1HIGH 7.5
TI-2025-38165 Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) CVSS 3.1HIGH 7.5
TI-2025-38163 Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) CVSS 3.1HIGH 7.5

See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences