Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2026-34830

Опубликовано: 02 апр. 2026
Источник: redhat
CVSS3: 5.9
EPSS Низкий

Описание

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is not escaped, an attacker who can supply X-Accel-Mapping to the backend can inject regex metacharacters and control the generated X-Accel-Redirect response header. In deployments using Rack::Sendfile with x-accel-redirect, this can allow an attacker to cause nginx to serve unintended files from configured internal locations. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

A flaw was found in Rack. A remote attacker can exploit this vulnerability by injecting regular expression metacharacters into the X-Accel-Mapping request header. This improper input validation in Rack::Sendfile#map_accel_path allows the attacker to control the generated X-Accel-Redirect response header. Consequently, in deployments using Rack::Sendfile with x-accel-redirect, this can cause nginx to serve unintended files from configured internal locations, leading to information disclosure.

Меры по смягчению последствий

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Logging Subsystem for Red Hat OpenShiftopenshift-logging/cluster-logging-operator-bundleFix deferred
Logging Subsystem for Red Hat OpenShiftopenshift-logging/cluster-logging-rhel9-operatorFix deferred
Logging Subsystem for Red Hat OpenShiftopenshift-logging/eventrouter-rhel9Fix deferred
Logging Subsystem for Red Hat OpenShiftopenshift-logging/fluentd-rhel9Fix deferred
Logging Subsystem for Red Hat OpenShiftopenshift-logging/log-file-metric-exporter-rhel9Fix deferred
Logging Subsystem for Red Hat OpenShiftopenshift-logging/logging-view-plugin-rhel9Fix deferred
Logging Subsystem for Red Hat OpenShiftopenshift-logging/vector-rhel9Fix deferred
Red Hat 3scale API Management Platform 23scale-amp20/backendFix deferred
Red Hat 3scale API Management Platform 23scale-amp20/systemFix deferred
Red Hat 3scale API Management Platform 23scale-amp21/backendFix deferred

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-625
https://bugzilla.redhat.com/show_bug.cgi?id=2454510rack: Rack: Information disclosure via regular expression injection in X-Accel-Mapping header

EPSS

Процентиль: 11%
0.00209
Низкий

5.9 Medium

CVSS3

Связанные уязвимости

CVSS3: 5.9
ubuntu
4 месяца назад

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is not escaped, an attacker who can supply X-Accel-Mapping to the backend can inject regex metacharacters and control the generated X-Accel-Redirect response header. In deployments using Rack::Sendfile with x-accel-redirect, this can allow an attacker to cause nginx to serve unintended files from configured internal locations. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

CVSS3: 5.9
nvd
4 месяца назад

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path interpolates the value of the X-Accel-Mapping request header directly into a regular expression when rewriting file paths for X-Accel-Redirect. Because the header value is not escaped, an attacker who can supply X-Accel-Mapping to the backend can inject regex metacharacters and control the generated X-Accel-Redirect response header. In deployments using Rack::Sendfile with x-accel-redirect, this can allow an attacker to cause nginx to serve unintended files from configured internal locations. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

CVSS3: 5.9
debian
4 месяца назад

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, ...

CVSS3: 5.9
github
4 месяца назад

Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect

CVSS3: 7.5
fstec
4 месяца назад

Уязвимость метода map_accel_path модульного интерфейса веб-сервера Rack языка программирования Ruby, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

EPSS

Процентиль: 11%
0.00209
Низкий

5.9 Medium

CVSS3