Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch

Summary Rack::Static normalizes the request path with Utils.cleanpathinfo when deciding which file to serve, but matches headerrules against a path that is only URL-decoded. A request containing dot segments, raw or percent-encoded, is served the normalized target file while the header rules for...

GHSA-WVG4-6P58-3GH3 Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch

Summary Rack::Static normalizes the request path with Utils.cleanpathinfo when deciding which file to serve, but matches headerrules against a path that is only URL-decoded. A request containing dot segments, raw or percent-encoded, is served the normalized target file while the header rules for...

CVE-2026-125110 Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.cleanpathinfo normalization but evaluates headerrules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encode...

CVE-2026-34786

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Staticapplicablerules evaluates several headerrules types against the raw URL-encoded PATHINFO, while the underlying file-serving path is decoded before the file is served. As a result, a request for a...

CVE-2026-34786: Incorrect Behavior Order: Validate Before Canonicalize

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Staticapplicablerules evaluates several headerrules types against the raw URL-encoded PATHINFO, while the underlying file-serving path is decoded before the file is served. As a result, a request for a...