CVE-2026-34835

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-34835
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-34835.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-34835
Aliases
Downstream
Related
Published
2026-04-02T17:09:07.047Z
Modified
2026-04-06T00:44:17.357422620Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Rack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass.
Details

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host header using an AUTHORITY regular expression that accepts characters not permitted in RFC-compliant hostnames, including /, ?, #, and @. Because req.host returns the full parsed value, applications that validate hosts using naive prefix or suffix checks can be bypassed. This can lead to host header poisoning in applications that use req.host, req.url, or req.base_url for link generation, redirects, or origin validation. This issue has been patched in versions 3.1.21 and 3.2.6.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34835.json",
    "cwe_ids": [
        "CWE-1286"
    ]
}
References

Affected packages

Git / github.com/rack/rack

Affected ranges

Type
GIT
Repo
https://github.com/rack/rack
Events
Introduced
572a42a705b423ce98ef4e81435d4f60fb0ae53d
Fixed
ae8431120e66e92d1885ab8ec0a553d9cad5ec13
Database specific 
{
    "versions": [
        {
            "introduced": "3.0.0.beta1"
        },
        {
            "fixed": "3.1.21"
        }
    ]
}
Type
GIT
Repo
https://github.com/rack/rack
Events
Introduced
b68251c03788ff39d4a4b25424df7360426e4afd
Fixed
e1f22fdbe99afd2126b6fbf05bb12399359574b7
Database specific 
{
    "versions": [
        {
            "introduced": "3.2.0"
        },
        {
            "fixed": "3.2.6"
        }
    ]
}

Affected versions

3.*
3.0.0
3.0.0.beta1
3.0.0.rc1
v3.*
v3.0.1
v3.0.10
v3.0.12
v3.0.13
v3.0.14
v3.0.15
v3.0.16
v3.0.17
v3.0.18
v3.0.2
v3.0.3
v3.0.4
v3.0.4.1
v3.0.4.2
v3.0.5
v3.0.6
v3.0.6.1
v3.0.7
v3.0.8
v3.0.9
v3.0.9.1
v3.1.0
v3.1.1
v3.1.10
v3.1.11
v3.1.12
v3.1.13
v3.1.14
v3.1.15
v3.1.16
v3.1.17
v3.1.18
v3.1.19
v3.1.2
v3.1.20
v3.1.3
v3.1.4
v3.1.5
v3.1.6
v3.1.7
v3.1.8
v3.1.9
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.2.4
v3.2.5
v3.2.6

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-34835.json"