CVE-2026-34830
Fixed in a distro release EPSS <1%CVSS 5.9
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is not escaped, an attacker who can supply X-Accel-Mapping to the backend can inject regex metacharacters and control the generated X-Accel-Redirect response header. In deployments using Rack::Sendfile with x-accel-redirect, this can allow an attacker to cause nginx to serve unintended files from configured internal locations. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
Products: Rack
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | rack | 2.2.23 |
| RubyGems | rack | 3.1.21 |
| RubyGems | rack | 3.2.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | gitlab-exporter-18.10 | 18.10.3-r0 |
| Chainguard | gitlab-exporter-18.7 | no fix |
| Chainguard | gitlab-exporter-18.8 | 18.8.9-r0 |
| Chainguard | gitlab-exporter-18.9 | 18.9.5-r0 |
| Chainguard | gitlab-rails-ce-18.1 | 18.1.6-r13 |
| Chainguard | gitlab-rails-ce-18.10 | 18.10.4-r0 |
| Chainguard | gitlab-rails-ce-18.2 | no fix |
| Chainguard | gitlab-rails-ce-18.3 | no fix |
| Chainguard | gitlab-rails-ce-18.4 | no fix |
| Chainguard | gitlab-rails-ce-18.5 | no fix |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | 18.8.10-r0 |
| Chainguard | gitlab-rails-ce-18.9 | 18.9.6-r0 |
| Chainguard | gitlab-rails-ce-fips-18.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.10 | 18.10.4-r0 |
| Chainguard | gitlab-rails-ce-fips-18.2 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.3 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.4 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.5 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | 18.8.10-r0 |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.6-r0 |
| Chainguard | kube-fluentd-operator | 1.18.2-r60 |
| Chainguard | kube-fluentd-operator | 1.18.2-r67 |
| Chainguard | logstash-8.17 | no fix |
| Chainguard | logstash-8.17-iamguarded-compat | no fix |
| Chainguard | logstash-8.17-with-output-opensearch | no fix |
| Chainguard | logstash-8.18 | no fix |
| Chainguard | logstash-8.18-iamguarded-compat | no fix |
| Chainguard | logstash-8.18-with-output-opensearch | no fix |
| Chainguard | logstash-8.19 | 8.19.14-r3 |
| Chainguard | logstash-8.19-iamguarded-compat | 8.19.14-r3 |
| Chainguard | logstash-8.19-with-output-opensearch | 8.19.14-r3 |
| Chainguard | logstash-9.0 | 9.0.8-r20 |
| Chainguard | logstash-9.0-iamguarded-compat | 9.0.8-r20 |
| Chainguard | logstash-9.0-with-output-opensearch | 9.0.8-r20 |
| Chainguard | logstash-9.1 | 9.1.10-r6 |
| Chainguard | logstash-9.1-bitnami-compat | 9.1.10-r6 |
| Chainguard | logstash-9.1-iamguarded-compat | 9.1.10-r6 |
| Chainguard | logstash-9.1-with-output-opensearch | 9.1.10-r6 |
| Chainguard | logstash-9.2 | 9.2.8-r2 |
| Chainguard | logstash-9.2-iamguarded-compat | 9.2.8-r2 |
| Chainguard | logstash-9.2-with-output-opensearch | 9.2.8-r2 |
| Chainguard | logstash-9.3 | 9.3.3-r2 |
| Chainguard | logstash-9.3-iamguarded-compat | 9.3.3-r2 |
| Chainguard | logstash-9.3-with-output-opensearch | 9.3.3-r2 |
| Chainguard | pact-broker-docker | 2.137.0.2.118.0-r4 |
| Chainguard | pact-broker-docker-fips | 2.137.0.2.118.0-r2 |
| Chainguard | ruby3.2-rack-2.2 | 2.2.23-r0 |
| Chainguard | ruby3.2-rails-7.2 | 7.2.3.1-r1 |
| Chainguard | ruby3.2-rails-7.2 | 7.2.3.1-r2 |
| Chainguard | ruby3.2-rails-8.0 | 8.0.5-r0 |
| Chainguard | ruby3.3-rack-2.2 | 2.2.23-r0 |
| Chainguard | ruby3.3-rack-2.2 | 2.2.22-r0 |
| Chainguard | ruby3.4-rack-2.2 | 2.2.23-r0 |
| Chainguard | ruby3.4-rails-7.2 | 7.2.3.1-r1 |
| Chainguard | ruby3.4-rails-8.0 | 8.0.5-r2 |
| Chainguard | ruby3.4-rails-8.0 | 8.0.5-r1 |
| Chainguard | ruby4.0-rack-2.2 | 2.2.23-r0 |
| Debian 12 | ruby-rack | 2.2.22-0+deb12u2 |
| Debian 13 | ruby-rack | 3.1.20-0+deb13u2 |
| Debian 14 | ruby-rack | 3.2.6-2 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP6 | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Server 16.0 | rmt-server | 3.1.0-160000.1.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | rmt-server | 3.1.0-160000.1.1 |
| Ubuntu 24.04 LTS | ruby-rack | 2.2.7-1ubuntu0.7 |
| Ubuntu 25.10 | ruby-rack | 3.1.16-0.1ubuntu0.3 |
| Ubuntu 26.04 LTS | ruby-rack | no fix |
| Ubuntu Pro 14.04 LTS | ruby-rack | no fix |
| Ubuntu Pro 14.04 LTS | ruby-rack | 1.5.2-3+deb8u3ubuntu1~esm11 |
| Ubuntu Pro 16.04 LTS | ruby-rack | 1.6.4-3ubuntu0.2+esm10 |
| Ubuntu Pro 18.04 LTS | ruby-rack | 1.6.4-4ubuntu0.2+esm10 |
| Ubuntu Pro 20.04 LTS | ruby-rack | 2.0.7-2ubuntu0.1+esm10 |
| Ubuntu Pro 22.04 LTS | ruby-rack | 2.1.4-5ubuntu1.2+esm3 |
| Wolfi | kube-fluentd-operator | 1.18.2-r60 |
| Wolfi | kube-fluentd-operator | 1.18.2-r67 |
| Wolfi | logstash-9.3 | 9.3.3-r2 |
| Wolfi | logstash-9.3-iamguarded-compat | 9.3.3-r2 |
| Wolfi | logstash-9.3-with-output-opensearch | 9.3.3-r2 |
| Wolfi | ruby3.2-rack-2.2 | 2.2.23-r0 |
| Wolfi | ruby3.3-rack-2.2 | 2.2.23-r0 |
| Wolfi | ruby3.3-rack-2.2 | 2.2.22-r0 |
| Wolfi | ruby3.4-rack-2.2 | 2.2.23-r0 |
| Wolfi | ruby4.0-rack-2.2 | 2.2.23-r0 |
| openSUSE Leap 16.0 | rmt-server | 3.1.0-160000.1.1 |
| openSUSE Tumbleweed | rubygem-rack-2.2 | 2.2.23-1.1 |