CVE-2026-34826

What it actually does

An unauthenticated remote attacker can cause a denial of service (DoS) by sending a crafted HTTP request with a specially formatted `Range` header. The vulnerability exists in the `Rack::Utils.get_byte_ranges` function, which fails to limit the number of byte ranges processed. A request containing a large number of small, overlapping ranges forces the server to consume excessive CPU, memory, I/O, and bandwidth resources while attempting to construct a multipart response, leading to resource exhaustion and making the application unavailable.

Why it matters to the business

This vulnerability can render web applications and services built on the Ruby Rack framework unavailable to legitimate users. An attacker can easily trigger this condition, causing service disruptions, potential revenue loss, and damage to the organization's reputation. The low attack complexity and lack of authentication requirements make any public-facing, vulnerable application a potential target for service outages.

How an attack unfolds

An attacker targets a web application that uses a vulnerable version of Rack to serve static files. The attacker constructs a standard HTTP GET request for a static file but includes a malicious `Range` header. This header contains an excessive number of small, comma-separated byte ranges, such as `bytes=0-0,0-0,0-0,...` repeated hundreds or thousands of times. When the vulnerable Rack server receives this request, it attempts to parse and process each individual range. This action triggers a disproportionately high resource consumption loop, overwhelming the server's CPU, memory, and I/O capabilities, leading to a denial of service where the server becomes unresponsive to all users.

How to fix it

To remediate this vulnerability, upgrade the Rack gem to a patched version. Depending on your current version branch, update to version 2.2.23, 3.1.21, 3.2.6, or a later release. Modify your application's `Gemfile` to require a non-vulnerable version (e.g., `gem 'rack', '~> 2.2.23'`) and then run `bundle update rack` to apply the changes. If an immediate upgrade is not feasible, a temporary mitigation can be implemented at a reverse proxy or WAF layer by creating rules to block or sanitize requests containing `Range` headers with an excessive number of parts.

How to confirm the fix worked

To validate the fix, confirm that your application's environment is using a patched version of the Rack gem (2.2.23+, 3.1.21+, or 3.2.6+). Check the installed version by running `bundle show rack` within your application's directory or by inspecting the `Gemfile.lock` file. To test for exposure on a non-production system, you can use a tool like `curl` to send a request with a malicious `Range` header: `curl -v -H "Range: bytes=0-0,1-1,2-2,3-3,4-4,5-5,6-6,7-7,8-8,9-9,10-10" http://<your-app>/<static-file>`. A vulnerable system will show high resource usage, while a patched system should handle or reject the request gracefully.

Typical attack path

1. The attacker identifies a target web application using a vulnerable version of the Rack framework for serving files.
2. The attacker crafts an HTTP request for a static file on the target server.
3. The attacker modifies the request to include a `Range` header with an abnormally large number of small byte ranges.
4. The attacker sends the malicious request to the server.
5. The server's Rack process consumes excessive resources trying to handle the multipart range request, leading to a denial of service.

How to detect it

To detect exploitation attempts, security teams should monitor web server access logs (e.g., Nginx, Apache, IIS) for HTTP requests containing `Range` headers with an unusually high number of comma-separated values. Correlate findings with server performance monitoring tools (APM, system metrics) to identify spikes in CPU, memory, or I/O that coincide with such requests. A sudden increase in server load originating from static file requests could be an indicator of an attack.

• http.headers.range contains 'bytes=' and more than 10 instances of ','
• REGEXP_MATCH(http.headers.range, 'bytes=([0-9]+-[0-9]+,){10,}')

What your security team should do

• Immediately prioritize patching all Ruby applications using the Rack framework to a secure version (2.2.23+, 3.1.21+, or 3.2.6+).
• Use software composition analysis (SCA) tools to identify all instances of the vulnerable Rack gem across your application portfolio.
• If patching is delayed, deploy a WAF rule to detect and block HTTP requests containing a `Range` header with a high number of comma-separated values (e.g., more than 10).
• Monitor server performance metrics (CPU, memory) for anomalies on applications that cannot be immediately patched.