CVE-2026-34826 Details

A denial-of-service vulnerability has been identified in Rack, a Ruby web server interface, in versions prior to 2.2.23, 3.1.21, and 3.2.6. The issue arises in the `Rack::Utils.get_byte_ranges` method, which parses the HTTP Range header without limiting the number of individual byte ranges. While a previous fix for CVE-2024-26141 prevents ranges that exceed the total file size, it does not address the quantity of overlapping ranges that can be submitted. An attacker can exploit this by sending numerous small, overlapping ranges, such as '0-0,0-0,0-0,...', leading to excessive consumption of CPU, memory, I/O, and bandwidth for each request. This creates a denial-of-service condition in Rack's file-serving paths that handle multipart byte range responses.

Users are advised to update Rack to version 2.2.23, 3.1.21, or 3.2.6, all of which include the necessary patch. Additionally, consider rejecting or normalizing multipart byte range requests that contain excessive range counts, disabling multipart range support where it is not needed, and applying request filtering or header restrictions at the reverse proxy or application boundary to limit abusive Range headers.