Rack is a modular Ruby web server interface. In versions prior to 2.2.23, 3.1.21, and 3.2.6, Rack::Files#fail incorrectly calculates the Content‑Length header by using String#size instead of String#bytesize when the response body contains multibyte UTF‑8 characters. If an attacker requests a non‑existent path that includes percent‑encoded UTF‑8 characters, the resulting 404 response reflects the requested path and the faulty Content‑Length is used. The declared length is smaller than the actual number of bytes transmitted, which leads to incorrect HTTP framing and may create response desynchronization for downstream consumers that rely on the Content‑Length value.

The affected product is Rack, a Ruby web server framework. Any release earlier than 2.2.23, 3.1.21, or 3.2.6 is vulnerable; the issue is identified by the rack:rack CPE.

The CVSS score of 4.8 indicates a moderate impact. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote HTTP request that targets the application; no local privilege escalation is required. Because exploitation only requires forging a URL with percent‑encoded UTF‑8 characters, the threat is limited to intentional response framing issues rather than data compromise or privilege gain.