Rack CVE-2026-34829

Remote unauthenticated attacker sending multipart/form-data requests WITHOUT Content-Length header (HTTP chunked transfer encoding) to Rack versions before 2.2.23, 3.1.21, 3.2.6. No victim interaction needed. Default configurations vulnerable.

Real-world risk is moderate-to-high for internet-facing Rack applications accepting file uploads. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely exploitable with low complexity and no authentication required, though impact is limited to availability (A:H). Attack execution is straightforward for any attacker capable of crafting HTTP requests with chunked encoding and omitting Content-Length headers. The absence of confirmed active exploitation (no CISA KEV listing) and lack of public proof-of-concept code reduce immediate urgency, but the attack primitive is trivial to implement using standard HTTP libraries. EPSS data not provided, but disk exhaustion DoS attacks are automatable and have clear technical impact. Primary risk factors include: prevalence of Rack in Ruby web stacks, ease of exploitation via standard HTTP features, and potential for persistent service disruption. Mitigation priority depends on application exposure and disk quota configurations-applications behind reverse proxies that enforce Content-Length or reject chunked uploads may have reduced exposure.

An unauthenticated attacker identifies a publicly accessible Ruby web application accepting file uploads (customer portal, content management system, etc.). Using a standard HTTP client library configured for chunked transfer encoding, the attacker sends a multipart/form-data POST request without a Content-Length header, streaming gigabytes of arbitrary data as a file upload. The Rack parser writes this data directly to disk without enforcing size limits, rapidly exhausting available disk space on the server. Once disk capacity is consumed, the application and potentially co-hosted services fail, legitimate users cannot upload files or perform disk-dependent operations, and system logging ceases, creating a denial-of-service condition requiring manual intervention to restore service.