UBUNTU-CVE-2026-26962: Medium severity ubuntu/ruby-rack vulnerability
Rack is a modular Ruby web server interface. From version 3.2.0 to before version 3.2.6, Rack::Multipart::Parser unfolds folded multipart part headers incorrectly. When a multipart header contains an obs-fold sequence, Rack preserves the embedded CRLF in parsed parameter values such as filename or name instead of removing the folded line break during unfolding. As a result, applications that later reuse those parsed values in HTTP response headers may be vulnerable to downstream header injection or response splitting. This issue has been patched in version 3.2.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 2.2.7-1ubuntu0.7 - Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 3.1.16-0.1ubuntu0.3 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.2.6
Event History
Frequently Asked Questions
Which deployments are exposed to practical exploitation?
Applications using Rack versions 3.2.0 through 3.2.5 are exposed if they accept multipart requests and later place parsed multipart parameter values, such as filename or name, into HTTP response headers.
What does an attacker need to send?
An attacker needs to submit a multipart request containing an obs-fold sequence in a part header. No privileges or user interaction are required, but exploitation depends on the application reusing the affected parsed value in a response header.
Are applications affected simply by running a vulnerable Rack version?
No. The parser behavior exists in the affected versions, but downstream header injection or response splitting requires application code to reuse a parsed multipart value in an HTTP response header.
What is the remediation?
Update Rack to version 3.2.6 or later. If updating cannot happen immediately, avoid using multipart-derived filename or name values in HTTP response headers.