Multipart Header Parsing Issue in Rack Web Server by Rack Foundation

CVE-2026-26962

What is CVE-2026-26962?

The Rack web server interface, utilized by Ruby applications, is susceptible to a vulnerability within its multipart header parsing functionality. Specifically, versions 3.2.0 through 3.2.5 mismanage obs-fold sequences in multipart headers, inadvertently retaining embedded carriage return and line feed (CRLF) characters. Consequently, applications that utilize these parsed values may unintentionally expose themselves to header injection attacks or response splitting issues when the values are reused in HTTP response headers. This scenario can lead to potential security breaches if exploited. The issue has been addressed in version 3.2.6, which is recommended for all users to upgrade to for enhanced security.

References