# CVE-2026-34835: Rack Rack::Request host allowlist bypass via Host header poisoning

Source: https://junglewise.ai/threats/cve-2026-34835-rack-rack-request-host-allowlist-bypass-via-host-header-poisoning  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-02. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-34835 · Severity: medium · CVSS 4.8 · Published 2026-04-02

Rack is a standard interface used by many Ruby web applications to handle web requests. A vulnerability in how it handles 'Host' headers allows attackers to bypass security checks by including special characters that the system incorrectly accepts. This can lead to 'host header poisoning,' where an attacker tricks the application into generating malicious links, performing unauthorized redirects, or bypassing security filters intended to restrict access to trusted domains.

Technologies: [rack (RubyGems)](https://junglewise.ai/threats/technologies/rack). Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-34835 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34835 being exploited in the wild.

**How severe is CVE-2026-34835?** Medium severity, with a CVSS score of 4.8, published 2 April 2026.

**Which products and versions are affected?** rack (RubyGems) ECOSYSTEM:introduced=3.0.0.beta1,fixed=3.1.21.

**Is there a fix for CVE-2026-34835?** Yes. rack (RubyGems): upgrade to 3.1.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34835 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-34835?** Check whether you run rack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- rack (RubyGems): upgrade to 3.1.21 or later

  ```sh
  bundle update rack
  ```


## Technical details

The Rack::Request component uses an AUTHORITY regular expression that fails to strictly adhere to RFC 3986. It accepts non-compliant characters such as '/', '?', '#', and '@' in the Host header. Because req.host returns the full unvalidated string, applications performing naive validation (e.g., using .start_with? or .end_with?) can be bypassed by an attacker-controlled Host header like 'myapp.com@evil.com'. This enables host header poisoning, which can be leveraged for malicious link generation, open redirects, or origin validation bypass. The issue is fixed in Rack versions 3.1.21 and 3.2.6.

## Affected products

- Rack Rack >= 3.0.0.beta1, < 3.1.21; >= 3.2.0, < 3.2.6

## Identifiers

- CVE-2026-34835
- GHSA-g2pf-xv49-m2h5

## Timeline

- 2026-04-01: advisory: GitHub Security Advisory published
- 2026-04-02: disclosed: CVE-2026-34835 published to NVD

## References

- [https://github.com/rack/rack/security/advisories/GHSA-g2pf-xv49-m2h5](https://github.com/rack/rack/security/advisories/GHSA-g2pf-xv49-m2h5)

## Related threats

- [Rack multipart parser denial of service via unbounded scan buffer growth](https://junglewise.ai/threats/cve-2026-125111-rack-multipart-parsing-allows-dos-via-unbounded-scan-buffer)
- [Rack::Static header_rules bypass via dot-segment normalization mismatch](https://junglewise.ai/threats/cve-2026-125110-rack-rack-static-header-rules-bypass-via-dot-segment)
- [Rack host validation bypass via HTTP headers](https://junglewise.ai/threats/cve-2026-125109-rack-is-a-modular-ruby-web-server-interface-from-3-0-until-3-1)
- [Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8…](https://junglewise.ai/threats/cve-2026-125108-rack-multipart-boundary-ambiguity-guard-in-rack-multipart-parser)
- [Rack algorithmic complexity denial of service in Multipart Parser](https://junglewise.ai/threats/cve-2026-34827-rack-algorithmic-complexity-denial-of-service-in-multipart-parser)