Detections
Analytics
Ruby Rack 3.x < 3.1.21 / 3.2.x < 3.2.6 Multiple Vulnerabilities
high Nessus Plugin ID 305961
Synopsis
The remote host has an application installed that is affected by multiple vulnerabilities.Description
The version of the Rack Ruby library installed on the remote host is 3.0.0.beta1 or later but prior to 3.1.21, or is 3.2.0 or later but prior to 3.2.6. It is, therefore, affected by multiple vulnerabilities:- Rack::Multipart::Parser#handle_mime_head parses quoted multipart parameters using repeated String#index searches with String#slice! prefix deletion. For escape-heavy quoted values, this causes super-linear processing leading to denial of service (CVE-2026-34827)
- Rack::Request parses Host header using AUTHORITY regex accepting characters not permitted in RFC-compliant hostnames (/, ?, #, @). Applications validating hosts with naive prefix/suffix checks can be bypassed, leading to host header poisoning (CVE-2026-34835)
- Rack::Utils.forwarded_values parses RFC 7239 Forwarded header by splitting on semicolons before handling quoted-string values, allowing parameter smuggling (CVE-2026-32762)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Rack version 3.1.21 or 3.2.6 or later.See Also
https://github.com/rack/rack/security/advisories/GHSA-v6x5-cg8r-vv6x
https://github.com/rack/rack/security/advisories/GHSA-g2pf-xv49-m2h5
https://github.com/rack/rack/security/advisories/GHSA-qfgr-crr9-7r49
Plugin Details
Severity: High
ID: 305961
File Name: ruby_gem_rack_3_2_6_2026.nasl
Version: 1.1
Type: Local
Agent: windows, macosx, unix
Family: Misc.
Published: 4/10/2026
Updated: 4/10/2026
Configuration: Enable thorough checks (optional)
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: High
Base Score: 8.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:C
CVSS Score Source: CVE-2026-34827
CVSS v3
Risk Factor: High
Base Score: 7.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability Information
CPE: cpe:/a:ruby:rack
Required KB Items: Host/ruby/modules/enumerated
Patch Publication Date: 4/2/2026
Vulnerability Publication Date: 4/2/2026