CVE-2026-26961

Summary

Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first.

In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated.

Details

Rack identifies the multipart boundary using logic equivalent to:

MULTIPART = %r|\Amultipart/.*boundary=\"?([^\";,]+)\"?|ni

Because the expression is greedy, it matches the last boundary= parameter in a header such as:

Content-Type: multipart/form-data; boundary=safe; boundary=malicious

As a result, Rack parses the request body using malicious, while another component may interpret the same header using safe.

This creates an interpretation conflict. If an upstream WAF or proxy inspects multipart parts using the first boundary and Rack later parses the body using the last boundary, a client may be able to place malicious form fields or uploaded content in parts that Rack accepts but the upstream component did not inspect as intended.

This issue is most relevant in layered deployments where security decisions are made before the request reaches Rack.

Impact

Applications that accept multipart/form-data uploads behind an inspecting proxy or WAF may be affected.

In such deployments, an attacker may be able to bypass upstream filtering of uploaded files or form fields by sending a request with multiple boundary parameters and relying on the intermediary and Rack to parse the request differently.

The practical impact depends on deployment architecture. If no upstream component relies on a different multipart interpretation, this behavior may not provide meaningful additional attacker capability.

Mitigation

• Update to a patched version of Rack that rejects ambiguous multipart Content-Type headers or parses duplicate boundary parameters consistently.
• Reject requests containing multiple boundary parameters.
• Normalize or regenerate multipart metadata at the trusted edge before forwarding requests to Rack.
• Avoid relying on upstream inspection of malformed multipart requests unless duplicate parameter handling is explicitly consistent across components.

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

CVE-2026-26961 Greedy multipart boundary parsing can cause parser differentials and WAF bypass. Forwarded header semicolon injection enables Host and Scheme spoofing. CVE-2026-34230 Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header. CVE-2026-34763 Root directory disclosure via unescaped regex interpolation in Rack::Directory. CVE-2026-34785 Rack::Static prefix matching can expose unintended files under the static root. CVE-2026-34786 Rack::Static header_rules bypass via URL-encoded path mismatch. CVE-2026-34826 Multipart byte range processing allows denial of service via excessive overlapping ranges. CVE-2026-34827 Multipart header parsing allows denial of service via escape-heavy quoted parameters. CVE-2026-34829 Multipart parsing without Content-Length header allows unbounded chunked file uploads. CVE-2026-34830 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect. CVE-2026-34831 Content-Length mismatch in Rack::Files error responses. CVE-2026-34835 Rack::Request accepts invalid Host characters, enabling host allowlist bypass.

These are all security issues fixed in the ruby4.0-rubygem-rack-2.2-2.2.23-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby4.0-rubygem-rack-3.2.8-1.1 package on the GA media of openSUSE Tumbleweed.

This update for rmt-server fixes the following issues:

Update to version 3.1 (bsc#1274715).

Security issues fixed:

• CVE-2026-26961: rack: greedy multipart boundary parsing can lead to parser differentials and WAF bypass (bsc#1261398).
• CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to downstream header injection and response splitting(bsc#1261471).
• CVE-2026-34763: rack: unescaped regex interpolation of configured root path can lead to root directory disclosure (bsc#1261406).
• CVE-2026-34230: rack: crafted Accept-Encoding headers can cause a denial of service (bsc#1261388).
• CVE-2026-34785: rack: prefix matching logic can lead to the exposure of unintended files under the static root (bsc#1261417).
• CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
• CVE-2026-34826: rack: missing individual byte range limit checks when parsing HTTP Range headers can lead to excessive resource consumption and a denial of service (bsc#1261436).
• CVE-2026-34829: rack: multipart parsing without Content-Length header can lead to unbounded chunked file uploads and a denial of service (bsc#1261447).
• CVE-2026-34230: rack: quadratic complexity when processing of wildcard Accept-Encoding headers can lead to a denial of service (bsc#1261388).
• CVE-2026-34830: rack: improper sanitization of the X-Accel-Mapping request header can lead to the exposure of unintended files via X-Accel-Redirect (bsc#1261458).
• CVE-2026-34831: rack: Content-Length header and body byte size mismatch when creating error responses can lead to incorrect HTTP response framing (bsc#1261466).

Other updates and bugfixes:

• Version 3.1:
  • Remove all errors and warnigs due to new Ruby and Ruby on Rails versions
• Version 2.28:
  • Set arch to unknown for Rancher based products (jsc#SCC-759)
  • Fix purge for large amount of systems (bsc#1262706)
  • Change data type to MEDIUMTEXT in profiles table (bsc#1268305)
  • Remove proxy_byos column
  • Fix race condition when no system matches (bsc#1268301)
  • Fix race condition for PAYG (bsc#1268149)
  • Fix race condition to update a system (bsc#1268303)
• Version 2.27:
  • Fix ReDoS vulnerability in Addressable
  • Fixes out-of-bounds read vulnerability in rdiscount

This update for rmt-server fixes the following issues:

Update to version 2.27.

Security issues fixed:

• CVE-2026-26961: rack: greedy multipart boundary parsing can lead to parser differentials and WAF bypass (bsc#1261398).
• CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to downstream header injection and response splitting(bsc#1261471).
• CVE-2026-34763: rack: unescaped regex interpolation of configured root path can lead to root directory disclosure (bsc#1261406).
• CVE-2026-34785: rack: prefix matching logic can lead to the exposure of unintended files under the static root (bsc#1261417).
• CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
• CVE-2026-34826: rack: missing individual byte range limit checks when parsing HTTP Range headers can lead to excessive resource consumption and a denial of service (bsc#1261436).
• CVE-2026-34829: rack: multipart parsing without Content-Length header can lead to unbounded chunked file uploads and a denial of service (bsc#1261447).
• CVE-2026-34230: rack: quadratic complexity when processing of wildcard Accept-Encoding headers can lead to a denial of service (bsc#1261388).
• CVE-2026-34830: rack: improper sanitization of the X-Accel-Mapping request header can lead to the exposure of unintended files via X-Accel-Redirect (bsc#1261458).
• CVE-2026-34831: rack: Content-Length header and body byte size mismatch when creating error responses can lead to incorrect HTTP response framing (bsc#1261466).

Other updates and bugfixes:

• Fix ReDoS in Addressable.
• Fix out-of-bounds read in rdiscount.

This update for rmt-server fixes the following issues

• CVE-2026-26961: rack: mismatch in header handling can allow to smuggle multipart content (bsc#1261398).
• CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to header injection or response splitting (bsc#1261471).
• CVE-2026-34230: rack: crafted Accept-Encoding header can cause a denial of service (bsc#1261388).
• CVE-2026-34763: rack: failing of the prefix stripping can lead to information disclosure (bsc#1261406).
• CVE-2026-34785: rack: prefix matching can expose unintended files under the static root (bsc#1261417).
• CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
• CVE-2026-34826: rack: multipart byte range processing can allow denial of service (bsc#1261436).
• CVE-2026-34829: rack: multipart parsing without Content-Length header allows unbounded chunked file uploads (bsc#1261447).
• CVE-2026-34830: rack: crafted X-Accel-Mappingheaders can lead to regex injection (bsc#1261458).
• CVE-2026-34831: rack: Content-Length mismatch can lead to incorrectly framed error responses (bsc#1261466).

Other fixes:

• Update to version 2.27

This update for rmt-server fixes the following issues:

Update to version 3.1 (bsc#1274715).

Security issues fixed:

• CVE-2026-26961: rack: greedy multipart boundary parsing can lead to parser differentials and WAF bypass (bsc#1261398).
• CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to downstream header injection and response splitting(bsc#1261471).
• CVE-2026-34763: rack: unescaped regex interpolation of configured root path can lead to root directory disclosure (bsc#1261406).
• CVE-2026-34230: rack: crafted Accept-Encoding headers can cause a denial of service (bsc#1261388).
• CVE-2026-34785: rack: prefix matching logic can lead to the exposure of unintended files under the static root (bsc#1261417).
• CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
• CVE-2026-34826: rack: missing individual byte range limit checks when parsing HTTP Range headers can lead to excessive resource consumption and a denial of service (bsc#1261436).
• CVE-2026-34829: rack: multipart parsing without Content-Length header can lead to unbounded chunked file uploads and a denial of service (bsc#1261447).
• CVE-2026-34230: rack: quadratic complexity when processing of wildcard Accept-Encoding headers can lead to a denial of service (bsc#1261388).
• CVE-2026-34830: rack: improper sanitization of the X-Accel-Mapping request header can lead to the exposure of unintended files via X-Accel-Redirect (bsc#1261458).
• CVE-2026-34831: rack: Content-Length header and body byte size mismatch when creating error responses can lead to incorrect HTTP response framing (bsc#1261466).

Other updates and bugfixes:

• Version 3.1:
  • Remove all errors and warnigs due to new Ruby and Ruby on Rails versions
• Version 2.28:
  • Set arch to unknown for Rancher based products (jsc#SCC-759)
  • Fix purge for large amount of systems (bsc#1262706)
  • Change data type to MEDIUMTEXT in profiles table (bsc#1268305)
  • Remove proxy_byos column
  • Fix race condition when no system matches (bsc#1268301)
  • Fix race condition for PAYG (bsc#1268149)
  • Fix race condition to update a system (bsc#1268303)
• Version 2.27:
  • Fix ReDoS vulnerability in Addressable
  • Fixes out-of-bounds read vulnerability in rdiscount

This update for rmt-server fixes the following issues

• CVE-2026-26961: rack: mismatch in header handling can allow to smuggle multipart content (bsc#1261398).
• CVE-2026-26962: rack: improper unfolding of folded multipart headers can lead to header injection or response splitting (bsc#1261471).
• CVE-2026-34230: rack: crafted Accept-Encoding header can cause a denial of service (bsc#1261388).
• CVE-2026-34763: rack: failing of the prefix stripping can lead to information disclosure (bsc#1261406).
• CVE-2026-34785: rack: prefix matching can expose unintended files under the static root (bsc#1261417).
• CVE-2026-34786: rack: URL-encoded path mismatch can lead to header_rules bypass (bsc#1261426).
• CVE-2026-34826: rack: multipart byte range processing can allow denial of service (bsc#1261436).
• CVE-2026-34829: rack: multipart parsing without Content-Length header allows unbounded chunked file uploads (bsc#1261447).
• CVE-2026-34830: rack: crafted X-Accel-Mappingheaders can lead to regex injection (bsc#1261458).
• CVE-2026-34831: rack: Content-Length mismatch can lead to incorrectly framed error responses (bsc#1261466).

Changes for rmt-server:

• Updated to version 2.27

Andrew Lacambra discovered that Rack did not properly parse certain regular expressions. An attacker could possibly use this issue to bypass network security filters. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2026-26961)

William T. Nelson discovered that Rack did not handle multipart headers correctly. An attacker could possibly use this issue to cause downstream parsing issues or a denial of service. This issue only affected Ubuntu 25.10. (CVE-2026-26962)

It was discovered that Rack did not handle the Forwarded header correctly. An attacker could possibly use this issue to manipulate header values. This issue only affected Ubuntu 25.10. (CVE-2026-32762)

It was discovered that Rack could consume excessive CPU when handling certain Accept-Encoding values. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34230)

Haruki Oyama discovered that certain configurations of Rack could erroneously fail to derive the displayed directory path, and expose the full filesystem path. An attacker could possibly use this issue to disclose deployment details such as layout and usernames. (CVE-2026-34763)

It was discovered that Rack did not properly handle static file paths. An attacker could possibly use this issue to exfiltrate unintentionally served data. (CVE-2026-34785)

Haruki Oyama discovered that Rack did not apply header rules to certain requests for URL-encoded static paths. An attacker could possibly use this issue to bypass security-relevant response headers. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2026-34786)

It was discovered that Rack did not limit the number of ranges requested in the Range header. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2026-34826)

It was discovered that Rack could consume excessive CPU when parsing certain multipart parameters. An attacker could possibly use this to cause a denial of service. This issue only affected Ubuntu 25.10. (CVE-2026-34827)

It was discovered that Rack could consume unbounded disk space when handling requests without a Content-Length header. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2026-34829)

Mehtab Zafar discovered that Rack directly interpreted the X-Accel-Mapping header as a regular expression without escaping. An attacker could possibly use this issue to exfiltrate arbitrary files from internal locations. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2026-34830)

It was discovered that Rack did not properly handle messages with Unicode. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2026-34831)

It was discovered that Rack did not properly parse the Host header. An attacker could possibly use this issue to bypass security filters or poison generated links. This issue only affected Ubuntu 25.10. (CVE-2026-34835)

Andrew Lacambra discovered that Rack did not properly parse certain regular expressions. An attacker could possibly use this issue to bypass network security filters. (CVE-2026-26961)

William T. Nelson discovered that Rack did not handle multipart headers correctly. An attacker could possibly use this issue to cause downstream parsing issues or a denial of service. (CVE-2026-26962)

It was discovered that Rack did not handle the Forwarded header correctly. An attacker could possibly use this issue to manipulate header values. (CVE-2026-32762)

It was discovered that Rack could consume excessive CPU when handling certain Accept-Encoding values. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34230)

Haruki Oyama discovered that certain configurations of Rack could erroneously fail to derive the displayed directory path, and expose the full file system path. An attacker could possibly use this issue to disclose deployment details such as layout and usernames. (CVE-2026-34763)

It was discovered that Rack did not properly handle static file paths. An attacker could possibly use this issue to exfiltrate unintentionally served data. (CVE-2026-34785)

Haruki Oyama discovered that Rack did not apply header rules to certain requests for URL-encoded static paths. An attacker could possibly use this issue to bypass security-relevant response headers. (CVE-2026-34786)

It was discovered that Rack did not limit the number of ranges requested in the Range header. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34826)

It was discovered that Rack could consume excessive CPU when parsing certain multipart parameters. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34827)

It was discovered that Rack could consume unbounded disk space when handling requests without a Content-Length header. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34829)

Mehtab Zafar discovered that Rack directly interpreted the X-Accel-Mapping header as a regular expression without escaping. An attacker could possibly use this issue to exfiltrate arbitrary files from internal locations. (CVE-2026-34830)

It was discovered that Rack did not properly handle messages with Unicode. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-34831)

It was discovered that Rack did not properly parse the Host header. An attacker could possibly use this issue to bypass security filters or poison generated links. (CVE-2026-34835)