CVE-2026-34835: Rack Rack::Request host allowlist bypass via Host header poisoning

CVE-2026-34835 · Severity: medium · CVSS 4.8 · Published 2026-04-02

Rack is a standard interface used by many Ruby web applications to handle web requests. A vulnerability in how it handles 'Host' headers allows attackers to bypass security checks by including special characters that the system incorrectly accepts. This can lead to 'host header poisoning,' where an attacker tricks the application into generating malicious links, performing unauthorized redirects, or bypassing security filters intended to restrict access to trusted domains.

Technologies: rack (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-34835 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34835 being exploited in the wild.
How severe is CVE-2026-34835?
Medium severity, with a CVSS score of 4.8, published 2 April 2026.
Which products and versions are affected?
rack (RubyGems) ECOSYSTEM:introduced=3.0.0.beta1,fixed=3.1.21.
Is there a fix for CVE-2026-34835?
Yes. rack (RubyGems): upgrade to 3.1.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34835 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-34835?
Check whether you run rack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • rack (RubyGems): upgrade to 3.1.21 or later
    bundle update rack

Technical details

The Rack::Request component uses an AUTHORITY regular expression that fails to strictly adhere to RFC 3986. It accepts non-compliant characters such as '/', '?', '#', and '@' in the Host header. Because req.host returns the full unvalidated string, applications performing naive validation (e.g., using .start_with? or .end_with?) can be bypassed by an attacker-controlled Host header like 'myapp.com@evil.com'. This enables host header poisoning, which can be leveraged for malicious link generation, open redirects, or origin validation bypass. The issue is fixed in Rack versions 3.1.21 and 3.2.6.

Affected products

  • Rack Rack >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6

Identifiers

  • CVE-2026-34835
  • GHSA-g2pf-xv49-m2h5

Timeline

  • 2026-04-01: advisory: GitHub Security Advisory published
  • 2026-04-02: disclosed: CVE-2026-34835 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.