Executive brief
Rack is a foundational software component used by many Ruby-based web applications to handle web requests. A flaw in how it processes certain web headers allows an unauthenticated attacker to send a specially crafted request that forces the server to consume excessive CPU resources. This can lead to a denial of service, making the web application slow or completely unresponsive to legitimate users.
Technical details
A denial of service vulnerability exists in Rack due to inefficient algorithmic complexity (CWE-407) in the `Rack::Utils.select_best_encoding` method. When processing the `Accept-Encoding` HTTP header, the method recomputes the set of available encodings for every wildcard (*) entry present in the header, resulting in quadratic time complexity. An unauthenticated remote attacker can exploit this by sending a single request with a large number of wildcard entries (e.g., 1,000 entries in an 8 KB header) to trigger disproportionate CPU consumption within the `Rack::Deflater` middleware. This issue is resolved in versions 2.2.23, 3.1.21, and 3.2.6.
Affected products
- Rack Rack < 2.2.23, >= 3.0.0.beta1, < 3.1.21, >= 3.2.0, < 3.2.6
Timeline
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: NVD publication date