Rack EUVD-2026-18474

Remote unauthenticated attacker sends crafted multipart/form-data HTTP request with many parts containing long backslash-escaped Content-Disposition parameter values to Ruby applications using Rack versions 3.0.0.beta1–3.1.20 or 3.2.0–3.2.5. No victim interaction required.

This vulnerability presents moderate-to-high operational risk for production Ruby web applications. The CVSS 7.5 reflects the severe availability impact (A:H) combined with a trivially exploitable attack surface: network-accessible (AV:N), low complexity (AC:L), and no authentication required (PR:N). Any public-facing Rack application accepting multipart uploads is vulnerable to resource exhaustion attacks. However, risk is somewhat mitigated by the absence of confirmed active exploitation (no CISA KEV listing) and no publicly available proof-of-concept at time of analysis. The attack requires crafting malicious multipart payloads but demands no special access or user interaction (UI:N), making automated scanning feasible. Real-world impact depends on application request size limits, timeouts, and rate limiting - services without these protections face higher risk of successful DoS. The availability of vendor patches in actively maintained versions (3.1.21, 3.2.6) enables straightforward remediation, reducing window of exposure for diligent operators. Organizations running affected versions should prioritize patching, especially for internet-facing services handling untrusted file uploads.

An unauthenticated attacker identifies a public-facing Ruby on Rails application running vulnerable Rack 3.1.15 that accepts file uploads through a contact form or document submission feature. The attacker crafts a malicious HTTP POST request with Content-Type multipart/form-data containing a single form field with a Content-Disposition header featuring a name parameter with 10,000 consecutive backslash escape sequences. Upon receiving this request, the Rack multipart parser enters a super-linear processing loop, consuming a full CPU core for several seconds while parsing the deliberately malformed parameter. The attacker scripts this request to repeat every second from distributed sources, overwhelming application servers and preventing legitimate users from accessing the service, achieving complete denial of service without requiring authentication or triggering traditional rate limits focused on request volume rather than processing cost.