Rack CVE-2026-26961

The CVSS score of 3.7 reflects low severity (low impact, high attack complexity), indicating this is not a critical vulnerability on its face. However, the real-world risk is context-dependent. The attack vector is network-accessible and requires no authentication (PR:N), but attack complexity is high (AC:H), suggesting the attacker must craft a specific request structure. Integrity impact is low (I:L), as the primary concern is request smuggling to bypass inspection rather than data modification. The KEV (CISA Known Exploited Vulnerabilities) status is not confirmed in the provided data, and no public proof-of-concept is noted, indicating no confirmed active exploitation at the time of analysis. However, the vulnerability's practical impact is significant in specific deployment scenarios: organizations running Rack behind WAF or proxy infrastructure that validates multipart requests face a genuine request smuggling risk that could enable injection attacks, malware upload, or other payloads to bypass security controls. The high attack complexity mitigates this somewhat, but the presence of upstream inspection systems in many production deployments elevates the real-world concern beyond the CVSS score alone. This is a priority issue for Rack users in security-conscious deployments but lower risk for applications without upstream validation layers.

An attacker targets a Ruby web application (e.g., a Rails app) deployed behind a WAF configured to inspect multipart uploads for malicious content. The attacker crafts an HTTP POST request with a Content-Type header containing two boundary parameters: Content-Type: multipart/form-data; boundary=safe; boundary=exploit. The WAF sees the first boundary (safe) and validates the multipart body accordingly, allowing the request through. However, Rack's parser extracts the last boundary (exploit) and parses the body using that delimiter instead, revealing a hidden malicious payload (e.g., a PHP shell or malware) that was obscured from the WAF. The attacker's malicious file is then processed by the application, bypassing the upstream security control. Attack complexity is high because the attacker must carefully craft the multipart structure to be benign for the first boundary and malicious for the second, but such attacks are feasible with knowledge of the target application's form handling.