CVE-2026-34829: Rack Multipart Parsing Vulnerability Leading to Unbounded File Uploads
Summary
CVE-2026-34829: Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads. Affects rack across 3 version ranges.
< 2.2.23
>= 3.0.0.beta1, < 3.1.21
>= 3.2.0, < 3.2.6
Fixed in 2.2.23, 3.1.21 or 3.2.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rack is a modular Ruby web server interface that provides a minimal, modular, and adaptable interface for developing web applications. It is widely used in Ruby on Rails and other Ruby frameworks. Rack's multipart parsing functionality allows applications to handle file uploads via forms. However, a vulnerability exists in the way Rack handles multipart requests without a Content-Length header, which can lead to unbounded file uploads and potential denial of service.
Vulnerability Detail
The vulnerability arises from the Rack::Multipart::Parser class, which only wraps the request body in a BoundedIO when the CONTENT_LENGTH header is present. If a multipart/form-data request is sent without this header, such as in HTTP chunked transfer encoding, the parser continues reading the request body until the end of the stream without any size limit. This allows an unauthenticated attacker to upload arbitrarily large files, consuming disk space and potentially leading to denial of service for the application. The vulnerability is particularly concerning for applications that do not have upstream components enforcing request body size limits.
How To Fix
Latest published version: 3.2.7 as of 23 Oct 2026
gem install rack -v 3.2.7Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.2.232.2.23gem install rack -v 2.2.23 -
>= 3.0.0.beta1, < 3.1.213.1.21gem install rack -v 3.1.21 -
>= 3.2.0, < 3.2.63.2.6gem install rack -v 3.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can enforce request body size limits at the reverse proxy or application server level. This can help mitigate the risk of unbounded file uploads until you can update Rack to a patched version.
Conclusion
The CVE-2026-34829 vulnerability in Rack's multipart parsing mechanism poses a significant risk for applications that handle file uploads without proper size limits. It is crucial to update to the patched versions of Rack and implement additional safeguards to prevent potential denial of service attacks.
See every vulnerability recorded for rack →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Any Rack application that accepts multipart/form-data uploads may be at risk if no upstream component enforces a request body size limit.
If exploited, an attacker can consume disk space on the application host, leading to request failures, application instability, or broader service disruption.
Yes, isolating temporary upload storage and actively monitoring disk consumption for multipart endpoints can help manage and mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for rack.
