Remote Memory Exhaustion Vulnerability in Rack Modular Ruby Web Server Interface
CVE-2026-125111
What is CVE-2026-125111?
The Rack modular Ruby web server interface contains a memory exhaustion vulnerability that allows an unauthenticated attacker to exploit the Rack::Multipart::Parser. By crafting a well-formed multipart request body, the attacker can manipulate the internal StringScanner buffer, leading to excessive memory consumption. This occurs when multipart headers are parsed, specifically when the reads terminate within or just after these headers. The exploit targets specific memory alignment boundaries, causing the buffer to expand beyond normal limits. This impacts applications that rely on parsing multipart requests. Resolved in versions 2.2.25, 3.1.23, and 3.2.8, developers are urged to update to these versions to mitigate the risk.
Affected Version(s)
rack < 2.2.25 < 2.2.25
rack >= 3.0, < 3.1.23 < 3.0, 3.1.23
rack >= 3.2, < 3.2.8 < 3.2, 3.2.8