What is the CVSS score of CVE-2026-26961?

CVE-2026-26961 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-26961?

Yes, a patch is available for CVE-2026-26961. Update the affected software to the latest version immediately.

Rack CVE-2026-26961

EUVD-2026-18368 LOW

Interpretation Conflict (CWE-436)

2026-04-02 security-advisories@github.com

GHSA-vgpv-f759-9wx3

Information Disclosure Rack

3.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 03, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 02, 2026 - 17:22 euvd

EUVD-2026-18368

Analysis Generated

Apr 02, 2026 - 17:22 vuln.today

CVE Published

Apr 02, 2026 - 17:16 nvd

LOW 3.7

DescriptionGitHub Advisory

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

AnalysisAI

Rack's multipart form data parser uses a greedy regular expression that selects the last boundary parameter from a Content-Type header instead of the first, allowing request smuggling when upstream proxies or WAFs interpret the first boundary. This mismatch enables attackers to bypass upstream inspection by crafting multipart requests with duplicate boundary declarations, causing Rack to parse a different body structure than the intermediary validated. Affected versions are Rack prior to 2.2.23, 3.1.21, and 3.2.6; patches are available for all three release branches.

Technical ContextAI

Rack is a foundational Ruby web server interface specification that abstracts HTTP request/response handling. The Rack::Multipart::Parser component processes multipart/form-data requests, which are commonly used for file uploads and form submissions. The vulnerability stems from CWE-436 (Interpretation Conflict), where the parser's greedy regex extraction of the boundary parameter from the Content-Type header deviates from the HTTP specification's convention of using the first occurrence. The boundary parameter delimits form fields and file payloads in multipart bodies. When an intermediary (proxy, WAF, reverse proxy) parses the same header and selects the first boundary per standard convention, but Rack selects the last due to its greedy regex, the two systems interpret the request body differently. An attacker can exploit this discrepancy by including multiple boundary parameters in the Content-Type header, allowing content intended for the second (Rack-parsed) boundary to pass through upstream inspection configured for the first boundary.

RemediationAI

Vendor-released patches are available: upgrade Rack to version 2.2.23 or later for the 2.2.x branch, version 3.1.21 or later for the 3.1.x branch, or version 3.2.6 or later for the 3.2.x branch. For Rails applications, update the Rack gem in your Gemfile and run bundle update rack. For other Rack-based applications, update via your package manager or gem install. The fix modifies the boundary parameter extraction logic to use the first occurrence rather than the last, aligning Rack's parsing with upstream proxy and WAF behavior. No known workarounds exist short of upgrading, though organizations may temporarily mitigate risk by disabling upstream multipart inspection or implementing application-level validation until patches can be deployed. Consult the official advisory at https://github.com/rack/rack/security/advisories/GHSA-vgpv-f759-9wx3 for additional guidance and coordinated disclosure timeline.