Advisories ยป MGASA-2026-0226

Updated ruby-rack packages fix security vulnerabilities

Publication date: 18 Jun 2026
Modification date: 18 Jun 2026
Type: security
Affected Mageia releases : 9
CVE: CVE-2026-26961 , CVE-2026-32762 , CVE-2026-34230 , CVE-2026-34763 , CVE-2026-34785 , CVE-2026-34786 , CVE-2026-34826 , CVE-2026-34827 , CVE-2026-34829 , CVE-2026-34830 , CVE-2026-34831 , CVE-2026-34835

Description

CVE-2026-26961 Greedy multipart boundary parsing can cause parser
differentials and WAF bypass. `Forwarded` header semicolon injection
enables `Host` and `Scheme` spoofing.
CVE-2026-34230 Quadratic complexity in
`Rack::Utils.select_best_encoding` via wildcard `Accept-Encoding`
header.
CVE-2026-34763 Root directory disclosure via unescaped regex
interpolation in `Rack::Directory`.
CVE-2026-34785 `Rack::Static` prefix matching can expose unintended
files under the static root.
CVE-2026-34786 `Rack::Static` `header_rules` bypass via URL-encoded path
mismatch.
CVE-2026-34826 Multipart byte range processing allows denial of service
via excessive overlapping ranges.
CVE-2026-34827 Multipart header parsing allows denial of service via
escape-heavy quoted parameters.
CVE-2026-34829 Multipart parsing without `Content-Length` header allows
unbounded chunked file uploads.
CVE-2026-34830 `Rack::Sendfile` header-based `X-Accel-Mapping` regex
injection enables unauthorized `X-Accel-Redirect`.
CVE-2026-34831 `Content-Length` mismatch in `Rack::Files` error
responses.
CVE-2026-34835 `Rack::Request` accepts invalid Host characters, enabling
host allowlist bypass.

References

SRPMS

9/core