CVE-2026-34831 | Rack up to 2.2.22/3.1.20/3.2.5 Response Header Rack::Files Content-Length length parameter (GHSA-q2ww-5357-x388)

A vulnerability has been found in Rack up to 2.2.22/3.1.20/3.2.5 and classified as problematic. This affects the function Rack::Files of the component Response Header Handler. Performing a manipulation of the argument Content-Length results in improper handling of length parameter inconsistency.

This vulnerability is known as CVE-2026-34831. Remote exploitation of the attack is possible. No exploit is available.

The affected component should be upgraded.