CVE-2026-34230: 
Ruby vulnerability analysis and mitigation

CVE-2026-34230 is an algorithmic denial-of-service vulnerability in the Rack Ruby web server interface, specifically in Rack::Utils.select_best_encoding. When the Accept-Encoding HTTP header contains many wildcard (*) entries, the method processes them with quadratic time complexity, enabling an unauthenticated attacker to cause disproportionate CPU consumption via a single crafted request. Affected versions include Rack < 2.2.23, >= 3.0.0.beta1 and < 3.1.21, and >= 3.2.0 and < 3.2.6. The vulnerability was published on April 1–2, 2026. The CVSS v3.1 base score is 7.5 (High) per the GitHub Advisory Database, and 5.3 (Moderate) per the official security advisory (Github Advisory, Rack Advisory).

The root cause is an inefficient algorithm (CWE-407) leading to uncontrolled resource consumption (CWE-400) in Rack::Utils.select_best_encoding. When processing a wildcard (*) entry in the Accept-Encoding header, the method calls accept_encoding.map(&:first) inside a loop to compute the set of concrete encodings — this expression is re-evaluated for every wildcard entry, causing O(N²) complexity for N wildcard entries. Rack::Deflater invokes this method on every request when the middleware is enabled, making the vulnerable code path reachable by any unauthenticated HTTP client. A proof-of-concept scenario described in the advisory shows that an ~8 KB Accept-Encoding header with ~1,000 *;q=0.5 entries can consume approximately 170 ms of CPU time per request, compared to a negligible baseline. This issue is distinct from CVE-2024-26146, which involved regex-based ReDoS during header parsing rather than encoding selection (Github Advisory, Rack Advisory).

The vulnerability exclusively affects availability — there is no confidentiality or integrity impact. An unauthenticated attacker can send repeated single-request attacks with crafted Accept-Encoding headers to exhaust CPU resources on Rack worker processes, potentially rendering the application unresponsive to legitimate traffic. Only applications that have Rack::Deflater middleware enabled are affected; applications not using this middleware are not vulnerable (Github Advisory, Rack Advisory).

There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation as of the time of reporting (Github Advisory). The EPSS score is approximately 0.023% (7th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The attack requires no authentication, no special privileges, and no user interaction, making it trivially reachable on any internet-facing Rack application using Rack::Deflater.

1. Reconnaissance: Identify internet-facing Ruby web applications using Rack with Rack::Deflater middleware enabled. This can be inferred from HTTP response headers (e.g., Content-Encoding: gzip or deflate) or from application framework fingerprinting.
2. Craft malicious header: Construct an HTTP request with an oversized Accept-Encoding header containing a large number of wildcard entries, for example approximately 1,000 repetitions of *;q=0.5, resulting in a header of roughly 8 KB.
3. Send the request: Transmit the crafted HTTP request (any method, any endpoint) to the target application. No authentication or special body content is required.
4. Trigger CPU exhaustion: The Rack::Deflater middleware invokes Rack::Utils.select_best_encoding, which processes the wildcard entries with quadratic complexity, consuming ~170 ms of CPU per request.
5. Sustain denial of service: Repeat the request in a loop or from multiple sources to saturate available worker threads/processes, causing the application to become unresponsive to legitimate users (Github Advisory, Rack Advisory).

• Network: Repeated HTTP requests (any method/path) from one or more source IPs with abnormally large Accept-Encoding headers (>1 KB, containing many * or *;q=X entries); elevated request rate from a single client with minimal response body size.
• Logs: Web server or Rack access logs showing requests with Accept-Encoding header values containing many comma-separated wildcard entries; unusually high per-request processing latency logged by application performance monitoring.
• Process: Sustained high CPU utilization on Ruby worker processes (e.g., Puma, Unicorn, Passenger) without a corresponding increase in legitimate traffic volume; worker process timeouts or restarts correlated with specific request patterns.

Upgrade Rack to one of the patched versions: 2.2.23, 3.1.21, or 3.2.6, which fix the quadratic complexity in select_best_encoding (Github Advisory, Rack Advisory). As interim workarounds, consider: (1) disabling Rack::Deflater middleware if compression is not essential; (2) implementing rate limiting or header size restrictions at the reverse proxy (e.g., nginx, HAProxy) to reject requests with excessively large or complex Accept-Encoding headers; (3) restricting Rack::Deflater to trusted internal traffic only. IBM has also released patches for affected products including Aspera Faspex, Aspera Enterprise WebApps, Aspera Shares, API Connect, CloudPak for AIOps, and License Metric Tool (IBM Aspera Faspex, IBM CloudPak AIOps).

Ubuntu issued security notice USN-8182-1 addressing this vulnerability in the ruby-rack package (Ubuntu Advisory). SUSE released security updates SUSE-SU-2026:1745-1 and SUSE-SU-2026:1964-1 for affected SUSE and openSUSE distributions. IBM published multiple security bulletins covering affected products across its portfolio. The vulnerability was credited to reporter kwkr, remediation developer jeremyevans, and coordinator ioquatix (Rack Advisory).