CVE-2026-34835

Executive Summary

CVE-2026-34835 is a host header injection vulnerability in the Rack Ruby web server interface, affecting versions 3.0.0.beta1 through 3.1.20 and 3.2.0 through 3.2.5. The flaw resides in the Rack::Request class, which parses the Host header using an overly permissive regular expression (AUTHORITY). This regex accepts characters not permitted in RFC-compliant hostnames, including /, ?, #, and @. Because req.host returns the full parsed value without sanitization, applications that validate hosts using naive prefix or suffix checks can be bypassed. This can lead to host header poisoning in applications that use req.host, req.url, or req.base_url for link generation, redirects, or origin validation. The vulnerability has been patched in versions 3.1.21 and 3.2.6.

Supply Chain & Package Security

This vulnerability affects the Rack gem, a critical component of the Ruby web application ecosystem. Rack is used by frameworks like Ruby on Rails, Sinatra, and many others. A compromised Rack installation can lead to widespread host header poisoning across multiple applications. Organizations should audit their Gemfile.lock for affected versions and update immediately. The RubyGems package manager is the primary distribution channel, and no malicious packages have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

CVSS Score: 4.8 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required; the attacker simply sends a crafted HTTP request.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): Low – Limited information disclosure (e.g., redirecting to attacker-controlled sites).
• Integrity (I): Low – The attacker can manipulate host-based validation logic.
• Availability (A): None – No denial of service impact.

Threat Level: Medium. While the CVSS score is moderate, the widespread use of Rack in Ruby web applications makes this a significant supply chain risk. The lack of a public PoC or exploit code reduces immediate urgency, but the potential for host header poisoning in authentication or redirect flows is serious.

Deep Dive & Mechanics

The vulnerability lies in the Rack::Request class, specifically in the parsing of the Host header. Rack uses a regular expression (AUTHORITY) to extract the host from the Host header. The vulnerable regex accepts characters like /, ?, #, and @, which are not valid in RFC 3986 compliant hostnames. When an attacker sends a Host header such as example.com@evil.com, the req.host method returns example.com@evil.com instead of just example.com. Applications that perform naive prefix or suffix checks (e.g., if req.host.end_with?("example.com")) will incorrectly validate the host as legitimate, allowing the attacker to inject a malicious host.

The attack flow:

1. Attacker sends a request with a crafted Host header: Host: legitimate.com@evil.com
2. Rack parses this header and req.host returns legitimate.com@evil.com
3. The application checks req.host.end_with?("legitimate.com") – this returns true because the string ends with legitimate.com
4. The application trusts the host and generates a redirect URL using req.url or req.base_url, which now includes the attacker-controlled host
5. The victim is redirected to evil.com, leading to phishing or credential theft

The root cause is the permissive regex in the AUTHORITY pattern. The fix in versions 3.1.21 and 3.2.6 tightens this regex to reject characters like /, ?, #, and @, ensuring only valid hostname characters are accepted.

Vulnerable vs. Patched Code

Vulnerable Code (Rack < 3.1.21, < 3.2.6):

# In lib/rack/request.rb
AUTHORITY = /^(?:([^@]+)@)?([^:]+)(?::(\d+))?$/

This regex allows @ in the host part, which is the core issue.

Patched Code (Rack >= 3.1.21, >= 3.2.6):

# In lib/rack/request.rb
AUTHORITY = /^(?:([^@]+)@)?([a-zA-Z0-9.\-]+)(?::(\d+))?$/

The patched regex restricts the host part to only alphanumeric characters, dots, and hyphens, effectively blocking injection characters.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install a vulnerable Rack version: gem install rack -v 3.2.5
2. Create a simple Rack application that uses req.host for validation:

   # app.rb
   require 'rack'
   app = Proc.new do |env|
     req = Rack::Request.new(env)
     if req.host.end_with?("example.com")
       [200, {"Content-Type" => "text/html"}, ["Valid host: #{req.host}"]]
     else
       [403, {"Content-Type" => "text/html"}, ["Invalid host"]]
     end
   end
   run app
   

3. Start the server: rackup app.rb

Exploitation:

1. Send a crafted request using curl:

   curl -H "Host: example.com@evil.com" http://localhost:9292/
   

2. The server responds with Valid host: example.com@evil.com, confirming the bypass.
3. For a more impactful attack, use a redirect scenario:

   if req.host.end_with?("example.com")
     redirect_url = "https://#{req.host}/login"
     [302, {"Location" => redirect_url}, []]
   end
   

4. The victim is redirected to https://example.com@evil.com/login, which browsers may interpret as a URL with credentials, leading to phishing.

Blue Team

Detection:

1. Monitor HTTP requests for Host headers containing characters like @, /, ?, # outside of normal patterns.
2. Use WAF rules to block Host headers with these characters.
3. Check application logs for unusual Host header values.

Mitigation:

1. Update Rack to version 3.1.21 or 3.2.6 immediately.
2. Implement additional host validation in application code:

   def safe_host?(host)
     host.match?(/\A[a-zA-Z0-9.\-]+\z/)
   end
   

3. Use a reverse proxy (e.g., Nginx) to strip invalid characters from the Host header before it reaches the application.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with Host headers containing @, /, ?, # characters (e.g., Host: legitimate.com@evil.com)
  • Redirect responses (3xx) with Location headers containing @ in the host part
• Application Logs:
  • Log entries showing req.host values with special characters
  • Unusual redirect URLs in application logs
• File IOCs:
  • Presence of vulnerable Rack gem versions (3.0.0.beta1 to 3.1.20, 3.2.0 to 3.2.5) in Gemfile.lock

Detection Engineering

YARA Rule

rule CVE_2026_34835_Rack_Host_Header_Injection {
    meta:
        description = "Detects vulnerable Rack versions based on AUTHORITY regex pattern"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-34835"
    strings:
        $vuln_regex = /AUTHORITY\s*=\s*\/\^\(\?:\(\[\^@\]\+\)@\)\?\(\[\^:\]\+\)\(\?::\(\d\+\)\)\?\$\/ nocase
        $patched_regex = /AUTHORITY\s*=\s*\/\^\(\?:\(\[\^@\]\+\)@\)\?\(\[a-zA-Z0-9\.\\-\]\+\)\(\?::\(\d\+\)\)\?\$\/ nocase
    condition:
        $vuln_regex and not $patched_regex
}

Sigma Rule

title: CVE-2026-34835 Rack Host Header Injection Attempt
id: 8f7b3c2a-1d5e-4f9a-8c6b-7e2a3d4f5b6c
status: experimental
description: Detects HTTP requests with Host headers containing special characters (@, /, ?, #) indicative of CVE-2026-34835 exploitation
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-host|contains:
            - '@'
            - '/'
            - '?'
            - '#'
    condition: selection
falsepositives:
    - Legitimate use of IPv6 addresses with brackets
    - Rare cases of non-standard host headers
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-34835 Rack Host Header Injection Attempt"; flow:to_server; content:"Host|3a|"; nocase; pcre:"/Host:\s*[^\\r\\n]*[@\/?#]/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Update Rack to version 3.1.21 or 3.2.6. Run gem update rack and verify with gem list rack.
2. Application-Level Validation: Implement strict host validation in your application code. Use a whitelist of allowed hosts and validate against the full host string.
3. WAF Rules: Deploy web application firewall rules to block Host headers containing @, /, ?, # characters.
4. Reverse Proxy: Configure Nginx or Apache to validate and sanitize the Host header before forwarding to the application.
5. Monitoring: Enable logging of all Host header values and set up alerts for anomalous patterns.
6. Security Testing: Include host header injection tests in your CI/CD pipeline using tools like curl or Burp Suite.

Valters IT Securing the digital frontier, one CVE at a time.

{/* [Security Hash: 815BB8842FB4B97B59DB89C4] */}