Is CVE-2026-34826 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34826 being exploited in the wild.

How severe is CVE-2026-34826?

Medium severity, with a CVSS score of 5.3, published 2 April 2026.

Which products and versions are affected?

rack (RubyGems) ECOSYSTEM:introduced=0,fixed=2.2.23.

Is there a fix for CVE-2026-34826?

Yes. rack (RubyGems): upgrade to 2.2.23 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34826 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-34826?

Check whether you run rack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34826: Rack denial of service via excessive overlapping HTTP byte ranges

CVE-2026-34826 · Severity: medium · CVSS 5.3 · Published 2026-04-02

Rack is a widely used interface for Ruby web applications that handles communication between web servers and application code. A vulnerability in how it processes file download requests allows an attacker to send a specially crafted header that forces the server to perform excessive work. This can lead to a denial-of-service (DoS) condition, making the web application slow or completely unresponsive to legitimate users.

Technologies: rack (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-34826 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34826 being exploited in the wild.
How severe is CVE-2026-34826?: Medium severity, with a CVSS score of 5.3, published 2 April 2026.
Which products and versions are affected?: rack (RubyGems) ECOSYSTEM:introduced=0,fixed=2.2.23.
Is there a fix for CVE-2026-34826?: Yes. rack (RubyGems): upgrade to 2.2.23 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34826 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-34826?: Check whether you run rack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

rack (RubyGems): upgrade to 2.2.23 or later
```
bundle update rack
```

Technical details

The vulnerability exists in Rack::Utils.get_byte_ranges, which parses the HTTP Range header without limiting the total number of individual byte ranges requested. While a previous fix (CVE-2024-26141) restricted the total byte coverage, it did not limit the count of ranges. An unauthenticated remote attacker can provide a large number of small, overlapping ranges (e.g., '0-0,0-0,0-0...') to trigger disproportionate CPU, memory, and I/O consumption during multipart response generation. This results in a denial-of-service condition in file-serving paths. The issue is patched in versions 2.2.23, 3.1.21, and 3.2.6.

Affected products

Rack Rack < 2.2.23, >= 3.0.0.beta1, < 3.1.21, >= 3.2.0, < 3.2.6

Identifiers

CVE-2026-34826
GHSA-x8cg-fq8g-mxfx

Timeline

2026-04-01: advisory: GitHub Security Advisory published
2026-04-02: disclosed: NVD publication date

References

https://github.com/rack/rack/security/advisories/GHSA-x8cg-fq8g-mxfx

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.