CVE-2026-34831 Details
Description
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Files#fail sets the Content-Length response header using String#size instead of String#bytesize. When the response body contains multibyte UTF-8 characters, the declared Content-Length is smaller than the number of bytes actually sent on the wire. Because Rack::Files reflects the requested path in 404 responses, an attacker can trigger this mismatch by requesting a non-existent path containing percent-encoded UTF-8 characters. This results in incorrect HTTP response framing and may cause response desynchronization in deployments that rely on the incorrect Content-Length value. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
A vulnerability exists in Rack, a Ruby web server interface, in versions prior to 2.2.23, 3.1.21, and 3.2.6. The issue arises in the Rack::Files component, where the Content-Length response header is set using String#size instead of String#bytesize. This discrepancy can lead to incorrect HTTP response framing, particularly when the response body includes multibyte UTF-8 characters. An attacker can exploit this by requesting a non-existent path with percent-encoded UTF-8 characters, causing the declared Content-Length to underestimate the actual byte count sent. This mismatch may disrupt response synchronization in environments that depend on the accurate Content-Length value.
Users are advised to update to Rack versions 2.2.23, 3.1.21, or 3.2.6, which correctly calculate the Content-Length using String#bytesize. If an immediate update is not possible, consider avoiding direct exposure of Rack::Files to untrusted traffic, and where feasible, place Rack behind a proxy or server that can normalize or reject malformed responses. Additionally, prefer to close backend connections on error paths if there are concerns about response framing.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rack/rack/security/advisories/GHSA-q2ww-5357-x388 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-130 | Improper Handling of Length Parameter Inconsistency | [email protected] |
| CWE-135 | Incorrect Calculation of Multi-Byte String Length | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rack rack | < 2.2.23 >= 3.0.0, < 3.1.21 >= 3.2.0, < 3.2.6 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | Initial Analysis | [email protected] |
| Apr 2, 2026 | New CVE Received | [email protected] |