OPENSUSE-SU-2026:10508-1

Vulnerability from csaf_opensuse - Published: 2026-04-08 00:00 - Updated: 2026-04-08 00:00
Summary
ruby4.0-rubygem-rack-2.2-2.2.23-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: ruby4.0-rubygem-rack-2.2-2.2.23-1.1 on GA media
Description of the patch: These are all security issues fixed in the ruby4.0-rubygem-rack-2.2-2.2.23-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-10508
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-26961
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
CVE-2026-34230
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
CVE-2026-34763
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
CVE-2026-34785
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
CVE-2026-34786
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
CVE-2026-34826
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
CVE-2026-34829
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
CVE-2026-34830
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
CVE-2026-34831
4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
References
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/o… self
https://www.suse.com/security/cve/CVE-2026-26961/ self
https://www.suse.com/security/cve/CVE-2026-34230/ self
https://www.suse.com/security/cve/CVE-2026-34763/ self
https://www.suse.com/security/cve/CVE-2026-34785/ self
https://www.suse.com/security/cve/CVE-2026-34786/ self
https://www.suse.com/security/cve/CVE-2026-34826/ self
https://www.suse.com/security/cve/CVE-2026-34829/ self
https://www.suse.com/security/cve/CVE-2026-34830/ self
https://www.suse.com/security/cve/CVE-2026-34831/ self
https://www.suse.com/security/cve/CVE-2026-26961 external
https://bugzilla.suse.com/1261391 external
https://www.suse.com/security/cve/CVE-2026-34230 external
https://bugzilla.suse.com/1261384 external
https://www.suse.com/security/cve/CVE-2026-34763 external
https://bugzilla.suse.com/1261401 external
https://www.suse.com/security/cve/CVE-2026-34785 external
https://bugzilla.suse.com/1261415 external
https://www.suse.com/security/cve/CVE-2026-34786 external
https://bugzilla.suse.com/1261421 external
https://www.suse.com/security/cve/CVE-2026-34826 external
https://bugzilla.suse.com/1261431 external
https://www.suse.com/security/cve/CVE-2026-34829 external
https://bugzilla.suse.com/1261442 external
https://www.suse.com/security/cve/CVE-2026-34830 external
https://bugzilla.suse.com/1261453 external
https://www.suse.com/security/cve/CVE-2026-34831 external
https://bugzilla.suse.com/1261464 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the ruby4.0-rubygem-rack-2.2-2.2.23-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10508",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10508-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-26961 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-26961/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34230 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34230/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34763 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34763/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34785 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34785/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34786 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34786/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34826 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34826/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34829 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34829/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34830 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34830/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-34831 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-34831/"
      }
    ],
    "title": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-04-08T00:00:00Z",
      "generator": {
        "date": "2026-04-08T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10508-1",
      "initial_release_date": "2026-04-08T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-04-08T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
                "product": {
                  "name": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
                  "product_id": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
                "product": {
                  "name": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
                  "product_id": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
                "product": {
                  "name": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
                  "product_id": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64",
                "product": {
                  "name": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64",
                  "product_id": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64"
        },
        "product_reference": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le"
        },
        "product_reference": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x"
        },
        "product_reference": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
        },
        "product_reference": "ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-26961",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-26961"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-26961",
          "url": "https://www.suse.com/security/cve/CVE-2026-26961"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261391 for CVE-2026-26961",
          "url": "https://bugzilla.suse.com/1261391"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-08T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-26961"
    },
    {
      "cve": "CVE-2026-34230",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34230"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.select_best_encoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard (*) entries. Because this method is used by Rack::Deflater to choose a response encoding, an unauthenticated attacker can send a single request with a crafted Accept-Encoding header and cause disproportionate CPU consumption on the compression middleware path. This results in a denial of service condition for applications using Rack::Deflater. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34230",
          "url": "https://www.suse.com/security/cve/CVE-2026-34230"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261384 for CVE-2026-34230",
          "url": "https://bugzilla.suse.com/1261384"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-08T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-34230"
    },
    {
      "cve": "CVE-2026-34763",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34763"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Directory interpolates the configured root path directly into a regular expression when deriving the displayed directory path. If root contains regex metacharacters such as +, *, or ., the prefix stripping can fail and the generated directory listing may expose the full filesystem path in the HTML output. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34763",
          "url": "https://www.suse.com/security/cve/CVE-2026-34763"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261401 for CVE-2026-34763",
          "url": "https://bugzilla.suse.com/1261401"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-08T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-34763"
    },
    {
      "cve": "CVE-2026-34785",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34785"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as \"/css\", it matches any request path that begins with that string, including unrelated paths such as \"/css-config.env\" or \"/css-backup.sql\". As a result, files under the static root whose names merely share the configured prefix may be served unintentionally, leading to information disclosure. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34785",
          "url": "https://www.suse.com/security/cve/CVE-2026-34785"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261415 for CVE-2026-34785",
          "url": "https://bugzilla.suse.com/1261415"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-08T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-34785"
    },
    {
      "cve": "CVE-2026-34786",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34786"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static#applicable_rules evaluates several header_rules types against the raw URL-encoded PATH_INFO, while the underlying file-serving path is decoded before the file is served. As a result, a request for a URL-encoded variant of a static path can serve the same file without the headers that header_rules were intended to apply. In deployments that rely on Rack::Static to attach security-relevant response headers to static content, this can allow an attacker to bypass those headers by requesting an encoded form of the path. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34786",
          "url": "https://www.suse.com/security/cve/CVE-2026-34786"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261421 for CVE-2026-34786",
          "url": "https://bugzilla.suse.com/1261421"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-08T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-34786"
    },
    {
      "cve": "CVE-2026-34826",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34826"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.get_byte_ranges parses the HTTP Range header without limiting the number of individual byte ranges. Although the existing fix for CVE-2024-26141 rejects ranges whose total byte coverage exceeds the file size, it does not restrict the count of ranges. An attacker can supply many small overlapping ranges such as 0-0,0-0,0-0,... to trigger disproportionate CPU, memory, I/O, and bandwidth consumption per request. This results in a denial of service condition in Rack file-serving paths that process multipart byte range responses. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34826",
          "url": "https://www.suse.com/security/cve/CVE-2026-34826"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261431 for CVE-2026-34826",
          "url": "https://bugzilla.suse.com/1261431"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-08T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-34826"
    },
    {
      "cve": "CVE-2026-34829",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34829"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a BoundedIO when CONTENT_LENGTH is present. When a multipart/form-data request is sent without a Content-Length header, such as with HTTP chunked transfer encoding, multipart parsing continues until end-of-stream with no total size limit. For file parts, the uploaded body is written directly to a temporary file on disk rather than being constrained by the buffered in-memory upload limit. An unauthenticated attacker can therefore stream an arbitrarily large multipart file upload and consume unbounded disk space. This results in a denial of service condition for Rack applications that accept multipart form data. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34829",
          "url": "https://www.suse.com/security/cve/CVE-2026-34829"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261442 for CVE-2026-34829",
          "url": "https://bugzilla.suse.com/1261442"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-08T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-34829"
    },
    {
      "cve": "CVE-2026-34830",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34830"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is not escaped, an attacker who can supply X-Accel-Mapping to the backend can inject regex metacharacters and control the generated X-Accel-Redirect response header. In deployments using Rack::Sendfile with x-accel-redirect, this can allow an attacker to cause nginx to serve unintended files from configured internal locations. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34830",
          "url": "https://www.suse.com/security/cve/CVE-2026-34830"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261453 for CVE-2026-34830",
          "url": "https://bugzilla.suse.com/1261453"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-08T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-34830"
    },
    {
      "cve": "CVE-2026-34831",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-34831"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Files#fail sets the Content-Length response header using String#size instead of String#bytesize. When the response body contains multibyte UTF-8 characters, the declared Content-Length is smaller than the number of bytes actually sent on the wire. Because Rack::Files reflects the requested path in 404 responses, an attacker can trigger this mismatch by requesting a non-existent path containing percent-encoded UTF-8 characters. This results in incorrect HTTP response framing and may cause response desynchronization in deployments that rely on the incorrect Content-Length value. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
          "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-34831",
          "url": "https://www.suse.com/security/cve/CVE-2026-34831"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261464 for CVE-2026-34831",
          "url": "https://bugzilla.suse.com/1261464"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.aarch64",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.ppc64le",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.s390x",
            "openSUSE Tumbleweed:ruby4.0-rubygem-rack-2.2-2.2.23-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-08T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-34831"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.