Denial of Service Vulnerability in Rack Web Server Interface
CVE-2026-34827
What is CVE-2026-34827?
The Rack web server interface suffers from a Denial of Service vulnerability impacting versions from 3.0.0.beta1 to 3.2.5. The issue arises in the Rack::Multipart::Parser#handle_mime_head function, which inefficiently parses quoted multipart parameters using approach that leads to super-linear processing. An unauthenticated attacker could exploit this flaw by sending a specially crafted multipart/form-data request containing numerous parts with excessively long backslash-escaped parameter values. This results in excessive CPU consumption, potentially causing Rack applications that process multipart form data to experience a service disruption. The vulnerability has been patched in versions 3.1.21 and 3.2.6.
Affected Version(s)
rack >= 3.0.0.beta1, < 3.1.21 < 3.0.0.beta1, 3.1.21
rack >= 3.2.0, < 3.2.6 < 3.2.0, 3.2.6