# CVE-2026-125111: Rack multipart parser denial of service via unbounded scan buffer growth

Source: https://junglewise.ai/threats/cve-2026-125111-rack-multipart-parsing-allows-dos-via-unbounded-scan-buffer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-125111 · Severity: high · CVSS 7.5 · Published 2026-11-09

Rack is a widely-used Ruby web framework that handles HTTP requests, including file uploads and form submissions. A flaw in its multipart form parser allows attackers to craft specially-sized upload requests that cause the application to accumulate memory without releasing it, exhausting available memory and crashing the service.

Technologies: [rack (RubyGems)](https://junglewise.ai/threats/technologies/rack). Vendors: [Rack](https://junglewise.ai/threats/vendors/rack), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-125111 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125111 being exploited in the wild.

**How severe is CVE-2026-125111?** High severity, with a CVSS score of 7.5, published 9 November 2026.

**Which products and versions are affected?** Rack <UNKNOWN>; rack (RubyGems) < 2.2.25, ECOSYSTEM:introduced=0,fixed=2.2.25.

**Is there a fix for CVE-2026-125111?** Yes. rack (RubyGems): upgrade to 2.2.25 or later. Until then: Set `RACK_MULTIPART_PARSER_BYTESIZE_LIMIT` to the largest multipart body size your application needs to accept, or limit request body size at a reverse proxy or application boundary. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-125111 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-125111?** Check whether you run Rack or rack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- rack (RubyGems): upgrade to 2.2.25 or later

  ```sh
  bundle update rack
  ```


Set `RACK_MULTIPART_PARSER_BYTESIZE_LIMIT` to the largest multipart body size your application needs to accept, or limit request body size at a reverse proxy or application boundary.

## Technical details

The Rack::Multipart::Parser reads request bodies in 1 MiB chunks into a scan buffer but fails to discard parsed bytes when chunk boundaries align with part headers, allowing unbounded buffer growth. An attacker can construct multipart requests with parts sized to fit individual chunks and aligned to headers, reaching approximately 4 GiB of buffered memory per request without authentication or user interaction.

## Affected products

- Rack Rack <UNKNOWN>

## Identifiers

- CVE-2026-125111
- GHSA-5v64-555j-wjxm

## Timeline

- 2026-11-10: disclosed

## Related threats

- [Rack::Static header_rules bypass via dot-segment normalization mismatch](https://junglewise.ai/threats/cve-2026-125110-rack-rack-static-header-rules-bypass-via-dot-segment)
- [Rack host validation bypass via HTTP headers](https://junglewise.ai/threats/cve-2026-125109-rack-is-a-modular-ruby-web-server-interface-from-3-0-until-3-1)
- [Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8…](https://junglewise.ai/threats/cve-2026-125108-rack-multipart-boundary-ambiguity-guard-in-rack-multipart-parser)
- [Rack Rack::Request host allowlist bypass via Host header poisoning](https://junglewise.ai/threats/cve-2026-34835-rack-rack-request-host-allowlist-bypass-via-host-header-poisoning)
- [Rack algorithmic complexity denial of service in Multipart Parser](https://junglewise.ai/threats/cve-2026-34827-rack-algorithmic-complexity-denial-of-service-in-multipart-parser)