Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-34786

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static#applicable_rules evaluates several header_rules types against the raw URL-encoded PATH_INFO, while the underlying file-serving path is decoded before the file is served. As a result, a request for a URL-encoded variant of a static path can serve the same file without the headers that header_rules were intended to apply. In deployments that rely on Rack::Static to attach security-relevant respon
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:7faafd84fe0303b208cc89e230c56a0e71d7741b7ab8fbc00aa78aceb3786e79
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"rack","vendor":"rack","versions":[{"status":"affected","version":"< 2.2.23"},{"status":"affected","version":">= 3.0.0.beta1, < 3.1.21"},{"status":"affected","version":">= 3.2.0, < 3.2.6"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:577c4e360e010c4a9c257d317e97817958ccb351ce7de9ef8174ae8e77bab36f · sha256:0c038a4591ec44fd… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:577c4e360e010c4a9c257d317e97817958ccb351ce7de9ef8174ae8e77bab36f · sha256:0c038a4591ec44fd… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-180","description":"CWE-180: Incorrect Behavior Order: Validate Before Canonicalize","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:577c4e360e010c4a9c257d317e97817958ccb351ce7de9ef8174ae8e77bab36f · sha256:0c038a4591ec44fd… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion
{"name":"https://github.com/rack/rack/security/advisories/GHSA-q4qf-9j86-f5mh","tags":["x_refsource_CONFIRM"],"url":"https://github.com/rack/rack/security/advisories/GHSA-q4qf-9j86-f5mh"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:577c4e360e010c4a9c257d317e97817958ccb351ce7de9ef8174ae8e77bab36f · sha256:0c038a4591ec44fd… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer