CVE-2026-26962: Rack Multipart Parser CRLF Vulnerability Leading to Header Injection
Summary
CVE-2026-26962: Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values. Affects rack versions >= 3.2.0, < 3.2.6. Fixed in 3.2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rack is a modular Ruby web server interface that provides a standardized way for web applications to communicate with web servers. It is widely used in Ruby on Rails applications and other Ruby web frameworks. The Rack::Multipart::Parser is responsible for handling multipart form data, which is commonly used for file uploads and form submissions. This vulnerability arises from an improper handling of folded multipart headers, which can lead to security issues if the parsed values are reused in HTTP response headers.
Vulnerability Detail
The vulnerability in Rack's Multipart Parser stems from its incorrect unfolding of folded multipart part headers. Specifically, when a multipart header contains an obs-fold sequence, Rack preserves the embedded CRLF in parsed parameter values such as 'filename' or 'name'. This can result in downstream header injection or response splitting vulnerabilities when these values are reused in HTTP response headers. An attacker can exploit this by supplying a multipart parameter value with folded line breaks, potentially leading to cache poisoning or other response parsing issues.
How To Fix
Latest published version: 3.2.7 as of 23 Oct 2026
gem install rack -v 3.2.7Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.6
This is the first release that contains the fix.
gem install rack -v 3.2.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid copying upload metadata such as 'filename' directly into HTTP response headers without proper sanitization. Additionally, sanitize or reject carriage return and line feed characters in multipart-derived values before reusing them in response headers, logs, or other sensitive contexts.
Conclusion
The vulnerability identified as CVE-2026-26962 in Rack's Multipart Parser poses a risk of header injection and response splitting due to improper handling of folded multipart headers. It is crucial for developers to update to the patched version of Rack and implement recommended workarounds to mitigate potential security risks.
See every vulnerability recorded for rack →
FAQ
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Applications that accept multipart form uploads and reuse parsed multipart metadata in HTTP headers or other header-sensitive contexts are at risk.
If you cannot update Rack immediately, implement the suggested workarounds to sanitize or reject CRLF characters in multipart-derived values.
Yes, the vulnerability affects Rack versions prior to 3.2.6. Updating to this version or later will resolve the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for rack.
