Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypass_CVE-2026-26961

3.7 / 10

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

Basic Information

ID CVE-2026-26961

Source GitHub_M

Published Apr 2, 2026 at 16:42

Modified Apr 3, 2026 at 17:58

Affected Product

Vendor rack

Product rack

Version < 2.2.23

Affected Versions rack rack < 2.2.23
rack rack >= 3.0.0.beta1, < 3.1.21
rack rack >= 3.2.0, < 3.2.6

CWE Classification

CWE-436

References

github.com /rack/rack/security/advisories/GHSA-vgpv-f759-9wx3

{
    "lastseen": "",
    "description": "Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.",
    "published": "2026-04-02T16:42:16.766Z",
    "modified": "2026-04-03T17:58:12.149Z",
    "type": "cve",
    "title": "Rack: Multipart Boundary Parsing Ambiguity allowing WAF Bypass",
    "source": "GitHub_M",
    "references": "https://github.com/rack/rack/security/advisories/GHSA-vgpv-f759-9wx3",
    "id": "CVE-2026-26961",
    "bulletinFamily": "",
    "cwe": [
        "CWE-436"
    ],
    "cvelist": null,
    "sourceData": "rack rack < 2.2.23\nrack rack >= 3.0.0.beta1, < 3.1.21\nrack rack >= 3.2.0, < 3.2.6",
    "sourceHref": "",
    "cvss": {
        "score": 3.7,
        "severity": "LOW",
        "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "rack",
    "version": "< 2.2.23",
    "vendor": "rack",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}