CVE-2026-34835 - Rack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass.

Back Back to CVE browser

MEDIUM

Rack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass.

Published Apr 2, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.28%

Description

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host header using an AUTHORITY regular expression that accepts characters not permitted in RFC-compliant hostnames, including /, ?, #, and @. Because req.host returns the full parsed value, applications that validate hosts using naive prefix or suffix checks can be bypassed. This can lead to host header poisoning in applications that use req.host, req.url, or req.base_url for link generation, redirects, or origin validation. This issue has been patched in versions 3.1.21 and 3.2.6.

Affected products

Vendor Rack Product Rack Default
n/a
- Version
  >= 3.0.0.beta1, < 3.1.21
  Status
  affected
  Constraints
  -
- Version
  >= 3.2.0, < 3.2.6
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Rack

n/a

Version	Status	Constraints
>= 3.0.0.beta1, < 3.1.21	affected	-
>= 3.2.0, < 3.2.6	affected	-

Logging Subsystem for Red Hat OpenShift

openshift-logging/cluster-logging-operator-bundle

Fix deferred
Logging Subsystem for Red Hat OpenShift

openshift-logging/cluster-logging-rhel9-operator

Fix deferred
Logging Subsystem for Red Hat OpenShift

openshift-logging/eventrouter-rhel9

Fix deferred
Logging Subsystem for Red Hat OpenShift

openshift-logging/fluentd-rhel9

Fix deferred
Logging Subsystem for Red Hat OpenShift

openshift-logging/log-file-metric-exporter-rhel9

Fix deferred
Logging Subsystem for Red Hat OpenShift

openshift-logging/logging-view-plugin-rhel9

Fix deferred
Logging Subsystem for Red Hat OpenShift

openshift-logging/vector-rhel9

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp2/backend-rhel7

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp2/backend-rhel8

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp2/system-rhel7

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp2/system-rhel8

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp2/system-rhel9

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp2/zync-rhel7

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp2/zync-rhel8

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp2/zync-rhel9

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp20/backend

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp20/system

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp21/backend

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp21/system

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp21/zync

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp22/backend

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp22/system

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp22/zync

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp24/backend

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp24/system

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp24/zync

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp25/backend

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp25/system

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp25/zync

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp26/backend

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp26/system

Fix deferred
Red Hat 3scale API Management Platform 2

3scale-amp26/zync

Fix deferred
Red Hat Enterprise Linux 10

pcs

Fix deferred
Red Hat Enterprise Linux 7

pcs

Fix deferred
Red Hat Enterprise Linux 8

pcs

Fix deferred
Red Hat Enterprise Linux 9

pcs

Fix deferred
Red Hat Enterprise Linux 9

rhel9/ruby-30

Fix deferred
Red Hat Enterprise Linux 9

rhel9/ruby-33

Fix deferred
Red Hat Enterprise Linux 9

ubi9/ruby-30

Fix deferred
Red Hat Enterprise Linux 9

ubi9/ruby-33

Fix deferred

Product	Package	State	Advisory
Logging Subsystem for Red Hat OpenShift	openshift-logging/cluster-logging-operator-bundle	Fix deferred	n/a
Logging Subsystem for Red Hat OpenShift	openshift-logging/cluster-logging-rhel9-operator	Fix deferred	n/a
Logging Subsystem for Red Hat OpenShift	openshift-logging/eventrouter-rhel9	Fix deferred	n/a
Logging Subsystem for Red Hat OpenShift	openshift-logging/fluentd-rhel9	Fix deferred	n/a
Logging Subsystem for Red Hat OpenShift	openshift-logging/log-file-metric-exporter-rhel9	Fix deferred	n/a
Logging Subsystem for Red Hat OpenShift	openshift-logging/logging-view-plugin-rhel9	Fix deferred	n/a
Logging Subsystem for Red Hat OpenShift	openshift-logging/vector-rhel9	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp2/backend-rhel7	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp2/backend-rhel8	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp2/system-rhel7	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp2/system-rhel8	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp2/system-rhel9	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp2/zync-rhel7	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp2/zync-rhel8	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp2/zync-rhel9	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp20/backend	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp20/system	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp21/backend	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp21/system	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp21/zync	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp22/backend	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp22/system	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp22/zync	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp24/backend	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp24/system	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp24/zync	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp25/backend	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp25/system	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp25/zync	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp26/backend	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp26/system	Fix deferred	n/a
Red Hat 3scale API Management Platform 2	3scale-amp26/zync	Fix deferred	n/a
Red Hat Enterprise Linux 10	pcs	Fix deferred	n/a
Red Hat Enterprise Linux 7	pcs	Fix deferred	n/a
Red Hat Enterprise Linux 8	pcs	Fix deferred	n/a
Red Hat Enterprise Linux 9	pcs	Fix deferred	n/a
Red Hat Enterprise Linux 9	rhel9/ruby-30	Fix deferred	n/a
Red Hat Enterprise Linux 9	rhel9/ruby-33	Fix deferred	n/a
Red Hat Enterprise Linux 9	ubi9/ruby-30	Fix deferred	n/a
Red Hat Enterprise Linux 9	ubi9/ruby-33	Fix deferred	n/a

Remediation

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-1286

References (8)

https://access.redhat.com/security/cve/CVE-2026-34835
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2454482
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-18478
Advisory
https://github.com/advisories/GHSA-g2pf-xv49-m2h5
Advisory
https://github.com/rack/rack/security/advisories/GHSA-g2pf-xv49-m2h5
x_refsource_CONFIRMExploitMitigationVendor Advisory
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34835.yml
https://nvd.nist.gov/vuln/detail/CVE-2026-34835
https://www.cve.org/CVERecord?id=CVE-2026-34835

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-34835		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2454482		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-18478		Advisory
https://github.com/advisories/GHSA-g2pf-xv49-m2h5		Advisory
https://github.com/rack/rack/security/advisories/GHSA-g2pf-xv49-m2h5		x_refsource_CONFIRMExploitMitigationVendor Advisory
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-34835.yml
https://nvd.nist.gov/vuln/detail/CVE-2026-34835
https://www.cve.org/CVERecord?id=CVE-2026-34835