PT-2026-29815 · Rack+3 · Rack+3

Orenyomtov · Published 2026-04-02 · Updated 2026-05-13 · CVE-2026-34826

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.23, 3.1.21, and 3.2.6

Description The Rack::Utils.get byte ranges function parses the HTTP Range header without limiting the number of individual byte ranges. While a previous fix for CVE-2024-26141 prevents ranges exceeding the file size, it doesn't restrict the range count. An attacker can send numerous small, overlapping ranges (e.g., '0-0,0-0,0-0,...') to cause excessive CPU, memory, I/O, and bandwidth usage, leading to a denial of service in Rack file-serving paths processing multipart byte range responses. The function Rack::Utils.get byte ranges accepts a comma-separated list of byte ranges and validates them based on their aggregate size, but does not impose a limit on how many individual ranges may be supplied. The HTTP Range header is the vulnerable component.

Recommendations Update to Rack version 2.2.23 or later. Update to Rack version 3.1.21 or later. Update to Rack version 3.2.6 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2026-34826

GHSA-X8CG-FQ8G-MXFX

OPENSUSE-SU-2026:10508-1

USN-8182-1

Affected Products

Linuxmint

Rack

Red Os

Ubuntu

References · 36

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34826.yml · Exploit
• https://github.com/rack/rack/security/advisories/GHSA-x8cg-fq8g-mxfx · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8182-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34826 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34763 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34826 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-32762 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34829 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8182-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34230 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34826 · Security Note
• https://osv.dev/vulnerability/GHSA-x8cg-fq8g-mxfx · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34826 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34786 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34785 · Vendor Advisory