Skip to main content

Rack EUVDEUVD-2026-18368

| CVE-2026-26961 MEDIUM
Interpretation Conflict (CWE-436)
2026-04-02 security-advisories@github.com GHSA-vgpv-f759-9wx3
Information Disclosure Red Hat Rack Suse
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
SUSE
3.7 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Red Hat
3.7 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

6
Severity Changed
Jul 24, 2026 - 21:22 NVD
LOW MEDIUM
CVSS changed
Jul 24, 2026 - 21:22 NVD
3.7 (LOW) 5.3 (MEDIUM)
Patch released
Apr 03, 2026 - 02:30 nvd
Patch available
EUVD ID Assigned
Apr 02, 2026 - 17:22 euvd
EUVD-2026-18368
Analysis Generated
Apr 02, 2026 - 17:22 vuln.today
CVE Published
Apr 02, 2026 - 17:16 nvd
LOW 3.7

DescriptionNVD

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

AnalysisAI

Rack's multipart form data parser uses a greedy regular expression that selects the last boundary parameter from a Content-Type header instead of the first, allowing request smuggling when upstream proxies or WAFs interpret the first boundary. This mismatch enables attackers to bypass upstream inspection by crafting multipart requests with duplicate boundary declarations, causing Rack to parse a different body structure than the intermediary validated. Affected versions are Rack prior to 2.2.23, 3.1.21, and 3.2.6; patches are available for all three release branches.

Technical ContextAI

Rack is a foundational Ruby web server interface specification that abstracts HTTP request/response handling. The Rack::Multipart::Parser component processes multipart/form-data requests, which are commonly used for file uploads and form submissions. The vulnerability stems from CWE-436 (Interpretation Conflict), where the parser's greedy regex extraction of the boundary parameter from the Content-Type header deviates from the HTTP specification's convention of using the first occurrence. The boundary parameter delimits form fields and file payloads in multipart bodies. When an intermediary (proxy, WAF, reverse proxy) parses the same header and selects the first boundary per standard convention, but Rack selects the last due to its greedy regex, the two systems interpret the request body differently. An attacker can exploit this discrepancy by including multiple boundary parameters in the Content-Type header, allowing content intended for the second (Rack-parsed) boundary to pass through upstream inspection configured for the first boundary.

RemediationAI

Vendor-released patches are available: upgrade Rack to version 2.2.23 or later for the 2.2.x branch, version 3.1.21 or later for the 3.1.x branch, or version 3.2.6 or later for the 3.2.x branch. For Rails applications, update the Rack gem in your Gemfile and run bundle update rack. For other Rack-based applications, update via your package manager or gem install. The fix modifies the boundary parameter extraction logic to use the first occurrence rather than the last, aligning Rack's parsing with upstream proxy and WAF behavior. No known workarounds exist short of upgrading, though organizations may temporarily mitigate risk by disabling upstream multipart inspection or implementing application-level validation until patches can be deployed. Consult the official advisory at https://github.com/rack/rack/security/advisories/GHSA-vgpv-f759-9wx3 for additional guidance and coordinated disclosure timeline.

More in Rack

View all
CVE-2026-22860 HIGH POC
7.5 Feb 18

Directory traversal in Rack versions prior to 2.2.22, 3.1.20, and 3.2.5 allows unauthenticated remote attackers to list

CVE-2024-26141 HIGH POC
7.5 Feb 29

Rack is a modular Ruby web server interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable,
CVE-2024-25126 HIGH POC
7.5 Feb 29

Rack is a modular Ruby web server interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable,
CVE-2020-8184 HIGH POC
7.5 Jun 19

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 tha
CVE-2022-30123 CRITICAL
10.0 Dec 05

A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell

CVE-2025-25184 MEDIUM POC
5.7 Feb 12

Rack provides an interface for developing web applications in Ruby. Rated medium severity (CVSS 5.7), this vulnerability
CVE-2026-25500 MEDIUM POC
5.4 Feb 18

Rack's Directory module fails to sanitize filenames when generating HTML directory listings, allowing attackers to craft
CVE-2026-39324 CRITICAL
9.3 Apr 07

Session authentication bypass in Rack::Session::Cookie 2.0.0 through 2.1.1 allows unauthenticated remote attackers to fo
CVE-2020-8161 HIGH
8.6 Jul 02

A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerabi
CVE-2013-0263 MEDIUM
5.1 Feb 08

Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x
CVE-2025-46727 HIGH
7.5 May 07

Rack is a modular Ruby web server interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable,
CVE-2015-3225 MEDIUM
5.0 Jul 26

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products

Same weakness CWE-436 – Interpretation Conflict

View all
CVE-2026-63030 CRITICAL POC
9.8
CVE-2024-24754 CRITICAL POC
9.8
CVE-2023-24813 CRITICAL POC
9.8
CVE-2019-19589 CRITICAL POC
9.8
CVE-2025-12816 HIGH POC
8.6
CVE-2026-67201 HIGH POC
7.7
CVE-2026-13676 HIGH POC
7.5
CVE-2026-14643 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/rmt-server:2.27-79.22 Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Server 15 SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed

Share

EUVD-2026-18368 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy