Skip to content
Sign in Sign up
JA EN FR
SecPulse
Unrated

Security update for rmt-server

SUSE-SU-2026:1745-1 First seen on SecPulse

Summary

Vulnerability reported (SUSE-SU-2026:1745-1). Risk of unauthorized operations or information disclosure. Exploitable via header_rules.

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as SUSE-SU-2026:1745-1 has been found.
Attackers can target a specific entry point like header_rules over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "SUSE-SU-2026:1745-1" on the vendor's site.

SUSE-SU-2026:1745-1
Attack surface: header_rules / Range / Addressable / rdiscount
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

What is the problem

A vulnerability (unclassified) has been reported. Attackers reach the vulnerable code path via header_rules.

Affected scope

Check the vendor advisory for the affected versions. Attack surface: header_rules / Range / Addressable / rdiscount.

Severity

Severity: ?. Risk of unauthorized operations or information disclosure.

How to fix

Update to the patched release per vendor advisory.

Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposureidentify
    Audit SBOM/dependencies for affected components.

    資産台帳・SBOM・依存マニフェストで影響コンポーネントを特定する。

  2. 2
    Post-deployment verificationverify
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Original description The description as published by the source.

This update for rmt-server fixes the following issues:

Update to version 2.27.

Security issues fixed:

  • CVE-2026-26961: rack: greedy multipart boundary parsing can lead to parser differentials and WAF bypass
    (bsc#1261398).
  • CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to downstream header injection and
    response splitting(bsc#1261471).
  • CVE-2026-34763: rack: unescaped regex interpolation of configured root path can lead to root directory disclosure
    (bsc#1261406).
  • CVE-2026-34785: rack: prefix matching logic can lead to the exposure of unintended files under the static root
    (bsc#1261417).
  • CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
  • CVE-2026-34826: rack: missing individual byte range limit checks when parsing HTTP Range headers can lead to
    excessive resource consumption and a denial of service (bsc#1261436).
  • CVE-2026-34829: rack: multipart parsing without Content-Length header can lead to unbounded chunked file uploads
    and a denial of service (bsc#1261447).
  • CVE-2026-34230: rack: quadratic complexity when processing of wildcard Accept-Encoding headers can lead to a denial
    of service (bsc#1261388).
  • CVE-2026-34830: rack: improper sanitization of the X-Accel-Mapping request header can lead to the exposure of
    unintended files via X-Accel-Redirect (bsc#1261458).
  • CVE-2026-34831: rack: Content-Length header and body byte size mismatch when creating erro…

Source: OSV.dev (Open Source Vulnerabilities) OSV

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details