Vulnerability in Rack Web Server Interface Affects Multiple Versions
CVE-2026-125108
3.7LOW
What is CVE-2026-125108?
The vulnerability in Rack, a modular Ruby web server interface, allows for improper parsing of multipart Content-Type headers. Specifically, versions prior to 2.2.25, 3.1.23, and 3.2.8 have an issue with the Rack::Multipart::Parser.parse_boundary method, which can mistakenly skip leading empty or quoted boundary parameters. This flaw permits the acceptance of malformed requests, potentially allowing file uploads or form fields to bypass intended security measures such as web application firewalls or proxies. Users of affected versions are urged to update to the latest releases to mitigate this risk.
Affected Version(s)
rack < 2.2.25 < 2.2.25
rack >= 3.0, < 3.1.23 < 3.0, 3.1.23
rack >= 3.2, < 3.2.8 < 3.2, 3.2.8