Homepage

Partial Comparison The advisory has been revoked - it doesn't affect any version of package logstash-8.18-compat  (opens in a new tab)

Threat Intelligence

EPSS
0.39% (34th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-LOGSTASH818COMPAT-16339930
  • published2 May 2026
  • disclosed2 Apr 2026
Report a new vulnerability Found a mistake?

Introduced: 2 Apr 2026

CVE-2026-34785  (opens in a new tab)
CWE-187  (opens in a new tab)
CWE-200  (opens in a new tab)

Amendment

The Minimos security team deemed this advisory irrelevant for Minimos:latest.

NVD Description

Note: Versions mentioned in the description apply only to the upstream logstash-8.18-compat package and not the logstash-8.18-compat package as distributed by Minimos.

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as "/css", it matches any request path that begins with that string, including unrelated paths such as "/css-config.env" or "/css-backup.sql". As a result, files under the static root whose names merely share the configured prefix may be served unintentionally, leading to information disclosure. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.