CVE-2026-34827: Rack Denial of Service via Escape-Heavy Multipart Header Parsing
Summary
CVE-2026-34827: Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters. Affects rack across 2 version ranges.
>= 3.0.0.beta1, < 3.1.21
>= 3.2.0, < 3.2.6
Fixed in 3.1.21 or 3.2.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rack is a modular Ruby web server interface that provides a minimal, simple, and consistent API for web applications. It is widely used in Ruby on Rails and other Ruby frameworks to handle HTTP requests and responses. Rack's multipart parsing functionality allows applications to process file uploads and form submissions. However, this functionality can be exploited if not properly managed, leading to potential denial of service attacks.
Vulnerability Detail
The vulnerability arises from the way Rack's Multipart Parser handles quoted multipart parameters. Specifically, the method Rack::Multipart::Parser#handle_mime_head performs repeated searches and prefix deletions on strings containing escape-heavy quoted values. An attacker can craft a multipart/form-data request with numerous parts, each containing long backslash-escaped parameter values. This results in excessive CPU usage during parsing, leading to denial of service conditions in applications that accept such requests. The vulnerability is particularly concerning for endpoints that handle file uploads or standard HTML forms, as it can degrade service availability and tie up application workers.
How To Fix
Latest published version: 3.2.7 as of 23 Oct 2026
gem install rack -v 3.2.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.0.0.beta1, < 3.1.213.1.21gem install rack -v 3.1.21 -
>= 3.2.0, < 3.2.63.2.6gem install rack -v 3.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can implement request throttling or rate limiting on multipart upload endpoints to mitigate the impact of this vulnerability. Additionally, consider isolating multipart parsing on untrusted high-volume endpoints to reduce the risk of denial of service.
Conclusion
CVE-2026-34827 is a significant vulnerability in the Rack library that can lead to denial of service through malicious multipart requests. It is crucial for developers to update to the patched versions of Rack and consider implementing workarounds to protect their applications from potential exploitation.
See every vulnerability recorded for rack →
FAQ
CVE-2026-34827 is a vulnerability in the Rack library that allows an unauthenticated attacker to exploit multipart header parsing, leading to denial of service.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
The consequences include excessive CPU usage, reduced throughput, and potential denial of service for Rack applications that accept multipart form data.
If immediate updates are not possible, implement request throttling or rate limiting on multipart upload endpoints as a temporary workaround.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for rack.
