Denial of Service Vulnerability in Rack Modular Ruby Web Server Interface
CVE-2026-34829
What is CVE-2026-34829?
The Rack modular Ruby web server interface has a significant vulnerability related to how it handles multipart/form-data requests. When requests are made without a Content-Length header, such as those using HTTP chunked transfer encoding, the Rack::Multipart::Parser fails to constrain the file size. This allows an unauthenticated attacker to initiate a multipart file upload that can consume unbounded disk space, potentially leading to a denial of service for applications that accept such requests. This issue affects versions prior to 2.2.23, 3.1.21, and 3.2.6 and underscores the importance of applying updates to mitigate this risk.
Affected Version(s)
rack < 2.2.23 < 2.2.23
rack >= 3.0.0.beta1, < 3.1.21 < 3.0.0.beta1, 3.1.21
rack >= 3.2.0, < 3.2.6 < 3.2.0, 3.2.6