PT-2026-29809 · Rack+3 · Rack+3

Kwkr · Published 2026-04-02 · Updated 2026-05-13 · CVE-2026-34230

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.23, 3.1.21, and 3.2.6

Description Rack::Utils.select best encoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard (*) entries. Because this method is used by Rack::Deflater to choose a response encoding, an unauthenticated attacker can send a single request with a crafted Accept-Encoding header and cause disproportionate CPU consumption on the compression middleware path. This results in a denial of service condition for applications using Rack::Deflater. The attack does not require invalid HTTP syntax or large payload bodies. A single header-sized request is sufficient to reach the vulnerable code path.

Recommendations Update to Rack version 2.2.23, 3.1.21, or 3.2.6.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-407

CWE-400

Related Identifiers

CVE-2026-34230

GHSA-V569-HP3G-36WR

OPENSUSE-SU-2026:10508-1

USN-8182-1

Affected Products

Linuxmint

Rack

Red Os

Ubuntu

References · 36

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34230.yml · Exploit
• https://github.com/rack/rack/security/advisories/GHSA-v569-hp3g-36wr · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8182-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34763 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v569-hp3g-36wr · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34230 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-32762 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34829 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8182-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34230 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34826 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34230 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34786 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34785 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-26961 · Vendor Advisory