DEBIAN-CVE-2026-125108: Low severity debian/ruby-rack vulnerability

Q: Which deployments are realistically exposed to this issue?

Deployments using Rack multipart form parsing behind a conforming intermediary, reverse proxy, or web application firewall may be exposed if those components derive a different multipart boundary and therefore do not inspect fields or uploaded files that Rack accepts.

Q: What does an attacker need to send to exploit it?

An attacker needs to submit a multipart request whose Content-Type header includes a leading empty or quoted boundary parameter followed by another boundary parameter. Rack may select the later parameter while a conforming intermediary uses a different interpretation.

Q: Which Rack versions contain the fix?

The issue is fixed in Rack versions 2.2.25, 3.1.23, and 3.2.8. Earlier versions in those release lines are affected.

Published Nov 9, 2026

Updated

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parseboundary can skip a leading empty or quoted boundary parameter in a multipart Content-Type header and accept a later parameter. Rack can therefore parse a request body with a boundary that a conforming intermediary would not derive, allowing form fields or file uploads to reach an application without the intended proxy or web application firewall inspection. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8.

Affected Software

3 affected componentsFixes available

debian/ruby-rack*

debian/ruby-rack<3.2.8-1

3.2.8-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/ruby-rack to a version that resolves this vulnerability.
Fixed in 3.2.8-1
Upgrade
Upgrade rack to a version that resolves this vulnerability.
Fixed in 2.2.25
Upgrade
Upgrade rack to a version that resolves this vulnerability.
Fixed in 3.1.23
Upgrade
Upgrade rack to a version that resolves this vulnerability.
Fixed in 3.2.8

Event History

Nov 9, 2026

CVE Published

via OSV·10:18 PM

Data Sourced

via OSV·10:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

Deployments using Rack multipart form parsing behind a conforming intermediary, reverse proxy, or web application firewall may be exposed if those components derive a different multipart boundary and therefore do not inspect fields or uploaded files that Rack accepts.

What does an attacker need to send to exploit it?

An attacker needs to submit a multipart request whose Content-Type header includes a leading empty or quoted boundary parameter followed by another boundary parameter. Rack may select the later parameter while a conforming intermediary uses a different interpretation.

Which Rack versions contain the fix?

The issue is fixed in Rack versions 2.2.25, 3.1.23, and 3.2.8. Earlier versions in those release lines are affected.

DEBIAN-CVE-2026-125108: Low severity debian/ruby-rack vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

What does an attacker need to send to exploit it?

Which Rack versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

What does an attacker need to send to exploit it?

Which Rack versions contain the fix?