This security update for rmt-server resolves ten vulnerabilities related to the rack component. These include CVE-2026-26961 and CVE-2026-26962, which involve multipart content smuggling and header injection or response splitting due to improper header handling. Other issues fixed are denial of service caused by crafted Accept-Encoding headers (CVE-2026-34230), information disclosure from prefix stripping failures (CVE-2026-34763), exposure of unintended files due to prefix matching (CVE-2026-34785), bypass of header_rules through URL-encoded path mismatches (CVE-2026-34786), denial of service via multipart byte range processing (CVE-2026-34826), unbounded chunked file uploads without Content-Length headers (CVE-2026-34829), regex injection from crafted X-Accel-Mapping headers (CVE-2026-34830), and framing errors from Content-Length mismatches (CVE-2026-34831). The update to rmt-server version 2.27 addresses all these vulnerabilities.

The vulnerabilities collectively allow for potential header injection, response splitting, denial of service, information disclosure, exposure of unintended files, bypass of security header rules, unbounded file uploads, and regex injection. These issues could impact the security and stability of systems running affected versions of rmt-server, potentially leading to service disruption and unauthorized information exposure.

A security update is available that upgrades rmt-server to version 2.27, which fixes all listed vulnerabilities. Users should apply this update promptly to mitigate the risks. No additional vendor advisory content contradicts this guidance.