CVE-2026-26961: Rack interpretation conflict in Multipart Parser boundary extraction

CVE-2026-26961 · Severity: medium · CVSS 5.3 · Published 2026-04-02

Rack is a widely used interface for Ruby web applications that handles communication between web servers and application code. A flaw in how it processes web forms allows attackers to bypass security filters like Web Application Firewalls (WAFs). By sending specially crafted requests, an attacker can hide malicious data from security scanners while ensuring the application still processes it, potentially leading to unauthorized data modification or security policy bypass.

Technologies: rack (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-26961 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-26961 being exploited in the wild.
How severe is CVE-2026-26961?
Medium severity, with a CVSS score of 5.3, published 2 April 2026.
Which products and versions are affected?
rack (RubyGems) ECOSYSTEM:introduced=0,fixed=2.2.23.
Is there a fix for CVE-2026-26961?
Yes. rack (RubyGems): upgrade to 2.2.23 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26961 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-26961?
Check whether you run rack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • rack (RubyGems): upgrade to 2.2.23 or later
    bundle update rack

Technical details

A parser differential vulnerability exists in Rack's multipart/form-data handler due to the use of a greedy regular expression in Rack::Multipart::Parser. When a Content-Type header contains multiple boundary parameters, Rack selects the last occurrence, whereas many upstream proxies and Web Application Firewalls (WAFs) select the first. This interpretation conflict (CWE-436) allows an attacker to 'smuggle' multipart content past security intermediaries by having the intermediary inspect a 'safe' boundary while Rack processes a 'malicious' one. The issue is patched in versions 2.2.23, 3.1.21, and 3.2.6. Exploitation requires a layered architecture where an upstream component performs inspection based on the first boundary parameter.

Affected products

  • Rack Rack < 2.2.23, >= 3.0.0.beta1 < 3.1.21, >= 3.2.0 < 3.2.6

Identifiers

  • CVE-2026-26961
  • GHSA-vgpv-f759-9wx3

Timeline

  • 2026-04-01: advisory: GitHub Security Advisory published
  • 2026-04-02: disclosed: CVE-2026-26961 published to NVD
  • 2026-04-02: patched: Patched versions released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.