UBUNTU-CVE-2026-26961: Medium severity ubuntu/ruby-rack vulnerability
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 2.1.4-5ubuntu1.2+esm3 - Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 2.2.7-1ubuntu0.7 - Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 3.1.16-0.1ubuntu0.3 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 2.2.23 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.1.21 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.2.6
Event History
Frequently Asked Questions
Which deployments are exposed to this parsing mismatch?
Deployments are exposed when Rack processes multipart/form-data behind an upstream proxy, WAF, or other intermediary that interprets the first boundary parameter while vulnerable Rack selects the last one. The issue affects Rack versions before 2.2.23, 3.1.21, and 3.2.6.
What must an attacker do to exploit the issue?
An attacker must send a multipart/form-data request with multiple boundary parameters in the Content-Type header. Exploitation depends on an intermediary validating the request using the first boundary while Rack parses it using the last boundary.
What is the immediate remediation?
Upgrade Rack to version 2.2.23, 3.1.21, or 3.2.6, as appropriate for the deployed release line. These versions patch the boundary-parameter parsing behavior.