Search: CVE-2026-34835

A vulnerability in Ruby Rack versions from 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6 allows improper parsing of the Host header. The Rack::Request component uses a regular expression that accepts characters not allowed in RFC-compliant hostnames, which can lead to host header poisoning. This can bypass naive host validation in applications using req.host, req.url, or req.base_url for link generation, redirects, or origin validation. The issue has been fixed in versions 3.1.21 and 3.2.6.