CVE-2026-34827

Name	CVE-2026-34827
Description	Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Multipart::Parser#handle_mime_head parses quoted multipart parameters such as Content-Disposition: form-data; name="..." using repeated String#index searches combined with String#slice! prefix deletion. For escape-heavy quoted values, this causes super-linear processing. An unauthenticated attacker can send a crafted multipart/form-data request containing many parts with long backslash-escaped parameter values to trigger excessive CPU usage during multipart parsing. This results in a denial of service condition in Rack applications that accept multipart form data. This issue has been patched in versions 3.1.21 and 3.2.6.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ruby-rack (PTS)	bullseye	2.1.4-3+deb11u2	vulnerable
	bullseye (security)	2.1.4-3+deb11u5	vulnerable
	bookworm	2.2.20-0+deb12u1	vulnerable
	bookworm (security)	2.2.22-0+deb12u1	vulnerable
	trixie	3.1.18-1~deb13u1	vulnerable
	trixie (security)	3.1.20-0+deb13u1	vulnerable
	forky	3.1.18-1	vulnerable
	sid	3.2.5-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
ruby-rack	source	experimental	3.2.6-1
ruby-rack	source	(unstable)	(unfixed)

Notes

https://github.com/rack/rack/security/advisories/GHSA-v6x5-cg8r-vv6x
Fixed by: https://github.com/rack/rack/commit/bfb69142dbe2a1e3298ad52d12935938d1b58205 (v3.2.6)
Fixed by: https://github.com/rack/rack/commit/17ce7836be1523a7b453f3c06fe070ad7c954708 (v3.1.21)