Executive brief
Rack is a widely used interface for Ruby web applications that helps manage how web servers and applications communicate. A flaw in its static file handling component allows attackers to bypass security headers (such as those protecting against clickjacking or data theft) by using specially formatted web addresses. This could result in sensitive files being served without the intended security protections, potentially exposing users or data to web-based attacks.
Technical details
A canonicalization mismatch exists in Rack::Static#applicable_rules where header rules (such as :fonts, Array, or Regexp types) are evaluated against the raw, URL-encoded PATH_INFO. However, the underlying file-serving mechanism decodes the path before retrieving the file. An attacker can exploit this by requesting a URL-encoded version of a path (e.g., using %2E instead of a dot), which causes the header rules to fail to match while still serving the intended file. This results in the file being delivered without configured security headers like Content-Security-Policy or X-Frame-Options. The issue is fixed in versions 2.2.23, 3.1.21, and 3.2.6.
Affected products
- Rack Rack < 2.2.23, >= 3.0.0.beta1 < 3.1.21, >= 3.2.0 < 3.2.6
Timeline
- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: CVE published to NVD
- 2026-04-02: patched: Patched versions released