
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2026-34230 is an algorithmic denial-of-service vulnerability in the Rack Ruby web server interface, specifically in Rack::Utils.select_best_encoding. When the Accept-Encoding HTTP header contains many wildcard (*) entries, the method processes them with quadratic time complexity, enabling an unauthenticated attacker to cause disproportionate CPU consumption via a single crafted request. Affected versions include Rack < 2.2.23, >= 3.0.0.beta1 and < 3.1.21, and >= 3.2.0 and < 3.2.6. The vulnerability was published on April 1–2, 2026. The CVSS v3.1 base score is 7.5 (High) per the GitHub Advisory Database, and 5.3 (Moderate) per the official security advisory (Github Advisory, Rack Advisory).
The root cause is an inefficient algorithm (CWE-407) leading to uncontrolled resource consumption (CWE-400) in Rack::Utils.select_best_encoding. When processing a wildcard (*) entry in the Accept-Encoding header, the method calls accept_encoding.map(&:first) inside a loop to compute the set of concrete encodings — this expression is re-evaluated for every wildcard entry, causing O(N²) complexity for N wildcard entries. Rack::Deflater invokes this method on every request when the middleware is enabled, making the vulnerable code path reachable by any unauthenticated HTTP client. A proof-of-concept scenario described in the advisory shows that an ~8 KB Accept-Encoding header with ~1,000 *;q=0.5 entries can consume approximately 170 ms of CPU time per request, compared to a negligible baseline. This issue is distinct from CVE-2024-26146, which involved regex-based ReDoS during header parsing rather than encoding selection (Github Advisory, Rack Advisory).
The vulnerability exclusively affects availability — there is no confidentiality or integrity impact. An unauthenticated attacker can send repeated single-request attacks with crafted Accept-Encoding headers to exhaust CPU resources on Rack worker processes, potentially rendering the application unresponsive to legitimate traffic. Only applications that have Rack::Deflater middleware enabled are affected; applications not using this middleware are not vulnerable (Github Advisory, Rack Advisory).
There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation as of the time of reporting (Github Advisory). The EPSS score is approximately 0.023% (7th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The attack requires no authentication, no special privileges, and no user interaction, making it trivially reachable on any internet-facing Rack application using Rack::Deflater.
Rack::Deflater middleware enabled. This can be inferred from HTTP response headers (e.g., Content-Encoding: gzip or deflate) or from application framework fingerprinting.Accept-Encoding header containing a large number of wildcard entries, for example approximately 1,000 repetitions of *;q=0.5, resulting in a header of roughly 8 KB.Rack::Deflater middleware invokes Rack::Utils.select_best_encoding, which processes the wildcard entries with quadratic complexity, consuming ~170 ms of CPU per request.Accept-Encoding headers (>1 KB, containing many * or *;q=X entries); elevated request rate from a single client with minimal response body size.Accept-Encoding header values containing many comma-separated wildcard entries; unusually high per-request processing latency logged by application performance monitoring.Upgrade Rack to one of the patched versions: 2.2.23, 3.1.21, or 3.2.6, which fix the quadratic complexity in select_best_encoding (Github Advisory, Rack Advisory). As interim workarounds, consider: (1) disabling Rack::Deflater middleware if compression is not essential; (2) implementing rate limiting or header size restrictions at the reverse proxy (e.g., nginx, HAProxy) to reject requests with excessively large or complex Accept-Encoding headers; (3) restricting Rack::Deflater to trusted internal traffic only. IBM has also released patches for affected products including Aspera Faspex, Aspera Enterprise WebApps, Aspera Shares, API Connect, CloudPak for AIOps, and License Metric Tool (IBM Aspera Faspex, IBM CloudPak AIOps).
Ubuntu issued security notice USN-8182-1 addressing this vulnerability in the ruby-rack package (Ubuntu Advisory). SUSE released security updates SUSE-SU-2026:1745-1 and SUSE-SU-2026:1964-1 for affected SUSE and openSUSE distributions. IBM published multiple security bulletins covering affected products across its portfolio. The vulnerability was credited to reporter kwkr, remediation developer jeremyevans, and coordinator ioquatix (Rack Advisory).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."