Is CVE-2026-125111 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-125111 being exploited in the wild.

How severe is CVE-2026-125111?

High severity, with a CVSS score of 7.5, published 9 November 2026.

Which products and versions are affected?

Rack ; rack (RubyGems) < 2.2.25, ECOSYSTEM:introduced=0,fixed=2.2.25.

How is CVE-2026-125111 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-125111?

Check whether you run Rack or rack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125111: Rack multipart parser denial of service via unbounded scan buffer growth

Q: Is there a fix for CVE-2026-125111?

Yes. rack (RubyGems): upgrade to 2.2.25 or later. Until then: Set `RACK_MULTIPART_PARSER_BYTESIZE_LIMIT` to the largest multipart body size your application needs to accept, or limit request body size at a reverse proxy or application boundary. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-125111 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-125111?

Check whether you run Rack or rack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125111 · Severity: high · CVSS 7.5 · Published 2026-11-09

Rack is a widely-used Ruby web framework that handles HTTP requests, including file uploads and form submissions. A flaw in its multipart form parser allows attackers to craft specially-sized upload requests that cause the application to accumulate memory without releasing it, exhausting available memory and crashing the service.

Technologies: rack (RubyGems). Vendors: Rack, RubyGems.

Quick answers

Is CVE-2026-125111 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-125111 being exploited in the wild.
How severe is CVE-2026-125111?: High severity, with a CVSS score of 7.5, published 9 November 2026.
Which products and versions are affected?: Rack <UNKNOWN>; rack (RubyGems) < 2.2.25, ECOSYSTEM:introduced=0,fixed=2.2.25.
Is there a fix for CVE-2026-125111?: Yes. rack (RubyGems): upgrade to 2.2.25 or later. Until then: Set `RACK_MULTIPART_PARSER_BYTESIZE_LIMIT` to the largest multipart body size your application needs to accept, or limit request body size at a reverse proxy or application boundary. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-125111 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-125111?: Check whether you run Rack or rack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

rack (RubyGems): upgrade to 2.2.25 or later
```
bundle update rack
```

Set `RACK_MULTIPART_PARSER_BYTESIZE_LIMIT` to the largest multipart body size your application needs to accept, or limit request body size at a reverse proxy or application boundary.

Technical details

The Rack::Multipart::Parser reads request bodies in 1 MiB chunks into a scan buffer but fails to discard parsed bytes when chunk boundaries align with part headers, allowing unbounded buffer growth. An attacker can construct multipart requests with parts sized to fit individual chunks and aligned to headers, reaching approximately 4 GiB of buffered memory per request without authentication or user interaction.

Affected products

Rack Rack <UNKNOWN>

Identifiers

CVE-2026-125111
GHSA-5v64-555j-wjxm

Timeline

2026-11-10: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.