Is CVE-2026-34763 actively exploited?

No active exploitation of CVE-2026-34763 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-34763 be exploited remotely?

Yes. CVE-2026-34763 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-34763?

CVE-2026-34763 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-34763

MEDIUM

CVE-2026-34763

CWE-625Published: April 2, 2026· Updated: Apr 3, 2026

5.3

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:7.8th

Official Description

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Directory interpolates the configured root path directly into a regular expression when deriving the displayed directory path. If root contains regex metacharacters such as +, *, or ., the prefix stripping can fail and the generated directory listing may expose the full filesystem path in the HTML output. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

NVD Source

Technical Analysis

CVE-2026-34763 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.