CVE-2026-34827

Estado: ModificadaAlta (7.5)—

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Multipart::Parser#handle_mime_head parses quoted multipart parameters such as Content-Disposition: form-data; name="..." using repeated String#index searches combined with String#slice! prefix deletion. For escape-heavy quoted values, this causes super-linear processing. An unauthenticated attacker can send a crafted multipart/form-data request containing many parts with long backslash-escaped parameter values to trigger excessive CPU usage during multipart parsing. This results in a denial of service condition in Rack applications that accept multipart form data. This issue has been patched in versions 3.1.21 and 3.2.6.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.66%
Percentil entre todas las CVEs puntuadas: 50
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access85 %
Impacto principalT1499.004 Application or System Exploitationimpact90 %

AV:N/AC:L/PR:N/UI:N indica explotación remota sin autenticación (T1190). La descripción explícita de 'denial of service' por consumo de CPU mediante solicitudes multipart malformadas confirma T1499.004 (resource exhaustion CPU).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network Traffic Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Application Isolation and Sandboxing

Tecnologías afectadas (1)

Rack — Rack

CWE

CWE-400, CWE-407, CWE-770
CWE-770

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-34827",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-34827",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-02T18:42:04.834994Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "rack",
          "product": "rack",
          "versions": [
            {
              "status": "affected",
              "version": ">= 3.0.0.beta1, < 3.1.21"
            },
            {
              "status": "affected",
              "version": ">= 3.2.0, < 3.2.6"
            }
          ]
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:logging:5"
          ],
          "vendor": "Red Hat",
          "product": "Logging Subsystem for Red Hat OpenShift",
          "packageName": "openshift-logging/cluster-logging-operator-bundle",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:logging:5"
          ],
          "vendor": "Red Hat",
          "product": "Logging Subsystem for Red Hat OpenShift",
          "packageName": "openshift-logging/cluster-logging-rhel9-operator",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:logging:5"
          ],
          "vendor": "Red Hat",
          "product": "Logging Subsystem for Red Hat OpenShift",
          "packageName": "openshift-logging/eventrouter-rhel9",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:logging:5"
          ],
          "vendor": "Red Hat",
          "product": "Logging Subsystem for Red Hat OpenShift",
          "packageName": "openshift-logging/fluentd-rhel9",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:logging:5"
          ],
          "vendor": "Red Hat",
          "product": "Logging Subsystem for Red Hat OpenShift",
          "packageName": "openshift-logging/log-file-metric-exporter-rhel9",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:logging:5"
          ],
          "vendor": "Red Hat",
          "product": "Logging Subsystem for Red Hat OpenShift",
          "packageName": "openshift-logging/logging-view-plugin-rhel9",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:logging:5"
          ],
          "vendor": "Red Hat",
          "product": "Logging Subsystem for Red Hat OpenShift",
          "packageName": "openshift-logging/vector-rhel9",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp20/backend",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp20/system",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp21/backend",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp21/system",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp21/zync",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp22/backend",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp22/system",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp22/zync",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp24/backend",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp24/system",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp24/zync",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp25/backend",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp25/system",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp25/zync",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp26/backend",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp26/system",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp26/zync",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp2/backend-rhel7",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp2/backend-rhel8",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp2/system-rhel7",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp2/system-rhel8",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp2/system-rhel9",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp2/zync-rhel7",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp2/zync-rhel8",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:red_hat_3scale_amp:2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat 3scale API Management Platform 2",
          "packageName": "3scale-amp2/zync-rhel9",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "packageName": "pcs",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 7",
          "packageName": "pcs",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "packageName": "pcs",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "packageName": "pcs",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-04-02T18:16:33.490",
  "references": [
    {
      "url": "https://github.com/rack/rack/security/advisories/GHSA-v6x5-cg8r-vv6x",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-34827",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454501",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34827.json",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-407"
        },
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Multipart::Parser#handle_mime_head parses quoted multipart parameters such as Content-Disposition: form-data; name=\"...\" using repeated String#index searches combined with String#slice! prefix deletion. For escape-heavy quoted values, this causes super-linear processing. An unauthenticated attacker can send a crafted multipart/form-data request containing many parts with long backslash-escaped parameter values to trigger excessive CPU usage during multipart parsing. This results in a denial of service condition in Rack applications that accept multipart form data. This issue has been patched in versions 3.1.21 and 3.2.6."
    },
    {
      "lang": "es",
      "value": "Rack es una interfaz modular de servidor web Ruby. Desde las versiones 3.0.0.beta1 hasta antes de la 3.1.21, y de la 3.2.0 hasta antes de la 3.2.6, Rack::Multipart::Parser#handle_mime_head analiza parámetros multipart entrecomillados como Content-Disposition: form-data; name=\"...\" utilizando búsquedas repetidas de String#index combinadas con la eliminación de prefijos de String#slice!. Para valores entrecomillados con muchas secuencias de escape, esto causa un procesamiento superlineal. Un atacante no autenticado puede enviar una solicitud multipart/form-data manipulada que contiene muchas partes con valores de parámetros largos escapados con barra invertida para desencadenar un uso excesivo de la CPU durante el análisis multipart. Esto resulta en una condición de denegación de servicio en aplicaciones Rack que aceptan datos de formulario multipart. Este problema ha sido parcheado en las versiones 3.1.21 y 3.2.6."
    }
  ],
  "lastModified": "2026-07-24T21:10:00.143",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6948AAA6-873D-46BA-AA22-4C81138128E1",
              "versionEndExcluding": "3.1.21",
              "versionStartIncluding": "3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3FB592AD-E826-49BE-AC6D-E5F55FDCC96E",
              "versionEndExcluding": "3.2.6",
              "versionStartIncluding": "3.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}