5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34786

CVE-2026-34786: Rack: Rack::Static header_rules bypass via URL-encoded paths

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static#applicable_rules evaluates several header_rules types against the raw URL-encoded PATH_INFO, while the underlying file-serving path is decoded before the file is served. As a result, a request for a URL-encoded variant of a static path can serve the same file without the headers that header_rules were intended to apply. In deployments that rely on Rack::Static to attach security-relevant response headers to static content, this can allow an attacker to bypass those headers by requesting an encoded form of the path. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34786

CVE-2026-34786:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
rack	rubygems	< 2.2.23	2.2.23
rack	rubygems	>= 3.0.0.beta1, < 3.1.21	3.1.21
rack

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the Rack::Static middleware, specifically within the applicable_rules method. This method is responsible for determining which header_rules should be applied to a given request path. The vulnerability arises because this method was performing its checks on the raw, URL-encoded path from the request. However, the underlying file serving mechanism would decode the path before accessing the file. This discrepancy allowed an attacker to bypass header rules by crafting a URL with encoded characters. For example, a request for /fonts/test%2Ewoff would be served as /fonts/test.woff, but the header rules that should have been applied to .woff files would not be triggered because the check was performed on the encoded string.

The patch, found in commit 4207d22e58a41d57a2c6e1ed2602170504b000c7, addresses this by decoding the path using ::Rack::Utils.unescape_path(path) at the very beginning of the applicable_rules method. This ensures that all subsequent rule matching is performed on the canonical, decoded path, closing the bypass vulnerability. The primary vulnerable function is therefore Rack::Static.applicable_rules.

Vulnerable functions

Rack::Static.applicable_rules

lib/rack/static.rb

The `applicable_rules` function in `Rack::Static` was vulnerable because it matched `header_rules` against the raw, URL-encoded `PATH_INFO`. The patch fixes this by adding `path = ::Rack::Utils.unescape_path(path)` at the beginning of the function, ensuring that the path is decoded before the rules are applied. This prevents attackers from bypassing header rules by using URL-encoded characters in the path.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.