The rmt-server update to version 3.1 addresses several security issues primarily related to the rack component. These include CVE-2026-26961 (greedy multipart boundary parsing leading to parser differentials and WAF bypass), CVE-2026-26962 (improper unfolding of folded multipart headers causing header injection and response splitting), CVE-2026-34763 (unescaped regex interpolation causing root directory disclosure), CVE-2026-34230 (crafted Accept-Encoding headers causing denial of service), CVE-2026-34785 (prefix matching logic exposing unintended files), CVE-2026-34786 (URL-encoded path mismatch leading to header_rules bypass), CVE-2026-34826 (missing byte range limit checks causing excessive resource consumption and denial of service), CVE-2026-34829 (multipart parsing without Content-Length header allowing unbounded chunked uploads and denial of service), CVE-2026-34830 (improper sanitization of X-Accel-Mapping header exposing unintended files), and CVE-2026-34831 (Content-Length and body size mismatch causing incorrect HTTP response framing). Additional bug fixes and improvements were also included in versions 2.27 and 2.28.

The vulnerabilities can lead to denial of service conditions, exposure of sensitive files or directories, bypass of web application firewall protections, HTTP response splitting, and resource exhaustion. These impacts can degrade service availability, compromise confidentiality, and weaken security controls in affected rmt-server deployments.

Upgrade rmt-server to version 3.1 or later, which includes fixes for all listed security issues. This update removes errors and warnings related to newer Ruby and Ruby on Rails versions and addresses multiple security flaws. No alternative mitigations are indicated; applying the official update is required to remediate these vulnerabilities.