Most recent entries from all

bdu:2026-07731

BREW-mailcatcher-CVE-2026-34786 — Rack:: Static header_rules bypass via URL-encoded paths

Affected: Homebrew: mailcatcher

## Summary

`Rack::Static#applicable_rules` evaluates several `header_rules` types against the raw URL-encoded `PATH_INFO`, while the underlying file-serving path is decoded before the file is served. As a result, a request for a URL-encoded variant of a static path can serve the same file without the headers that `header_rules` were intended to apply.

In deployments that rely on `Rack::Static` to attach security-relevant response headers to static content, this can allow an attacker to bypass those headers by requesting an encoded form of the path.

## Details

`Rack::Static#applicable_rules` matches rule types such as `:fonts`, `Array`, and `Regexp` directly against the incoming `PATH_INFO`. For example:

```ruby when :fonts /\.(?:ttf|otf|eot|woff2|woff|svg)\z/.match?(path) when Array /\.(#{rule.join('|')})\z/.match?(path) when Regexp rule.match?(path) ```

These checks operate on the raw request path. If the request contains encoded characters such as `%2E` in place of `.`, the rule may fail to match even though the file path is later decoded and served successfully by the static file server.

For example, both of the following requests may resolve to the same file on disk:

```text /fonts/test.woff /fonts/test%2Ewoff ```

but only the unencoded form may receive the headers configured through `header_rules`.

This creates a canonicalization mismatch between the path used for header policy decisions and the path ultimately used for file serving.

## Impact

Applicat…

EUVD-2026-280205

fkie_cve-2026-34786

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static#applicable_rules evaluates several header_rules types against the raw URL-encoded PATH_INFO, while the underlying file-serving path is decoded before the file is served. As a result, a request for a URL-encoded variant of a static path can serve the same file without the headers that header_rules were intended to apply. In deployments that rely on Rack::Static to attach security-relevant response headers to static content, this can allow an attacker to bypass those headers by requesting an encoded form of the path. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

GHSA-q4qf-9j86-f5mh — Rack:: Static header_rules bypass via URL-encoded paths

Affected: RubyGems: rack

## Summary

## Details

`Rack::Static#applicable_rules` matches rule types such as `:fonts`, `Array`, and `Regexp` directly against the incoming `PATH_INFO`. For example:

```ruby when :fonts /\.(?:ttf|otf|eot|woff2|woff|svg)\z/.match?(path) when Array /\.(#{rule.join('|')})\z/.match?(path) when Regexp rule.match?(path) ```

For example, both of the following requests may resolve to the same file on disk:

```text /fonts/test.woff /fonts/test%2Ewoff ```

but only the unencoded form may receive the headers configured through `header_rules`.

This creates a canonicalization mismatch between the path used for header policy decisions and the path ultimately used for file serving.

## Impact

Applicat…

openSUSE-SU-2026:10508-1 — ruby4.0-rubygem-rack-2.2-2.2.23-1.1 on GA media

ruby4.0-rubygem-rack-2.2-2.2.23-1.1 on GA media

SUSE-SU-2026:23321-1 — Security update for rmt-server

Security update for rmt-server

UBUNTU-CVE-2026-34786

Affected: Ubuntu:Pro:14.04:LTS: ruby-rack, Ubuntu:Pro:16.04:LTS: ruby-rack, Ubuntu:Pro:18.04:LTS: ruby-rack, Ubuntu:Pro:22.04:LTS: ruby-rack, Ubuntu:24.04:LTS: ruby-rack, Ubuntu:25.10: ruby-rack, Ubuntu:26.04:LTS: ruby-rack

WID-SEC-W-2026-1687 — IBM License Metric Tool: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM License Metric Tool ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.