CVE-2026-26961
Fixed in a distro release EPSS <1%CVSS 3.7
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
Products: Rack
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | rack | 2.2.23 |
| RubyGems | rack | 3.1.21 |
| RubyGems | rack | 3.2.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | gitlab-exporter-18.10 | 18.10.3-r0 |
| Chainguard | gitlab-exporter-18.7 | no fix |
| Chainguard | gitlab-exporter-18.8 | 18.8.9-r0 |
| Chainguard | gitlab-exporter-18.9 | 18.9.5-r0 |
| Chainguard | gitlab-rails-ce-18.1 | 18.1.6-r13 |
| Chainguard | gitlab-rails-ce-18.10 | 18.10.4-r0 |
| Chainguard | gitlab-rails-ce-18.2 | no fix |
| Chainguard | gitlab-rails-ce-18.3 | no fix |
| Chainguard | gitlab-rails-ce-18.4 | no fix |
| Chainguard | gitlab-rails-ce-18.5 | no fix |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | 18.8.10-r0 |
| Chainguard | gitlab-rails-ce-18.9 | 18.9.6-r0 |
| Chainguard | gitlab-rails-ce-fips-18.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.10 | 18.10.4-r0 |
| Chainguard | gitlab-rails-ce-fips-18.2 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.3 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.4 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.5 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | 18.8.10-r0 |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.6-r0 |
| Chainguard | kube-fluentd-operator | 1.18.2-r67 |
| Chainguard | kube-fluentd-operator | 1.18.2-r60 |
| Chainguard | logstash-8.17 | no fix |
| Chainguard | logstash-8.17-iamguarded-compat | no fix |
| Chainguard | logstash-8.17-with-output-opensearch | no fix |
| Chainguard | logstash-8.18 | no fix |
| Chainguard | logstash-8.18-iamguarded-compat | no fix |
| Chainguard | logstash-8.18-with-output-opensearch | no fix |
| Chainguard | logstash-8.19 | 8.19.14-r3 |
| Chainguard | logstash-8.19-iamguarded-compat | 8.19.14-r3 |
| Chainguard | logstash-8.19-with-output-opensearch | 8.19.14-r3 |
| Chainguard | logstash-9.0 | 9.0.8-r20 |
| Chainguard | logstash-9.0-iamguarded-compat | 9.0.8-r20 |
| Chainguard | logstash-9.0-with-output-opensearch | 9.0.8-r20 |
| Chainguard | logstash-9.1 | 9.1.10-r6 |
| Chainguard | logstash-9.1-bitnami-compat | 9.1.10-r6 |
| Chainguard | logstash-9.1-iamguarded-compat | 9.1.10-r6 |
| Chainguard | logstash-9.1-with-output-opensearch | 9.1.10-r6 |
| Chainguard | logstash-9.2 | 9.2.8-r2 |
| Chainguard | logstash-9.2-iamguarded-compat | 9.2.8-r2 |
| Chainguard | logstash-9.2-with-output-opensearch | 9.2.8-r2 |
| Chainguard | logstash-9.3 | 9.3.3-r2 |
| Chainguard | logstash-9.3-iamguarded-compat | 9.3.3-r2 |
| Chainguard | logstash-9.3-with-output-opensearch | 9.3.3-r2 |
| Chainguard | pact-broker-docker | 2.137.0.2.118.0-r4 |
| Chainguard | pact-broker-docker-fips | 2.137.0.2.118.0-r2 |
| Chainguard | ruby3.2-rack-2.2 | 2.2.23-r0 |
| Chainguard | ruby3.2-rails-7.2 | 7.2.3.1-r2 |
| Chainguard | ruby3.2-rails-7.2 | 7.2.3.1-r1 |
| Chainguard | ruby3.2-rails-8.0 | 8.0.5-r0 |
| Chainguard | ruby3.3-rack-2.2 | 2.2.22-r0 |
| Chainguard | ruby3.3-rack-2.2 | 2.2.23-r0 |
| Chainguard | ruby3.4-rack-2.2 | 2.2.23-r0 |
| Chainguard | ruby3.4-rails-7.2 | 7.2.3.1-r1 |
| Chainguard | ruby3.4-rails-8.0 | 8.0.5-r2 |
| Chainguard | ruby3.4-rails-8.0 | 8.0.5-r1 |
| Chainguard | ruby4.0-rack-2.2 | 2.2.23-r0 |
| Debian 12 | ruby-rack | 2.2.22-0+deb12u2 |
| Debian 13 | ruby-rack | 3.1.20-0+deb13u2 |
| Debian 14 | ruby-rack | 3.2.6-2 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP6 | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Server 16.0 | rmt-server | 3.1.0-160000.1.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | rmt-server | 3.1.0-160000.1.1 |
| Ubuntu 24.04 LTS | ruby-rack | 2.2.7-1ubuntu0.7 |
| Ubuntu 25.10 | ruby-rack | 3.1.16-0.1ubuntu0.3 |
| Ubuntu 26.04 LTS | ruby-rack | no fix |
| Ubuntu Pro 14.04 LTS | ruby-rack | 1.5.2-3+deb8u3ubuntu1~esm11 |
| Ubuntu Pro 14.04 LTS | ruby-rack | no fix |
| Ubuntu Pro 16.04 LTS | ruby-rack | no fix |
| Ubuntu Pro 16.04 LTS | ruby-rack | 1.6.4-3ubuntu0.2+esm10 |
| Ubuntu Pro 18.04 LTS | ruby-rack | no fix |
| Ubuntu Pro 18.04 LTS | ruby-rack | 1.6.4-4ubuntu0.2+esm10 |
| Ubuntu Pro 20.04 LTS | ruby-rack | 2.0.7-2ubuntu0.1+esm10 |
| Ubuntu Pro 22.04 LTS | ruby-rack | 2.1.4-5ubuntu1.2+esm3 |
| Wolfi | kube-fluentd-operator | 1.18.2-r67 |
| Wolfi | kube-fluentd-operator | 1.18.2-r60 |
| Wolfi | logstash-9.3 | 9.3.3-r2 |
| Wolfi | logstash-9.3-iamguarded-compat | 9.3.3-r2 |
| Wolfi | logstash-9.3-with-output-opensearch | 9.3.3-r2 |
| Wolfi | ruby3.2-rack-2.2 | 2.2.23-r0 |
| Wolfi | ruby3.3-rack-2.2 | 2.2.22-r0 |
| Wolfi | ruby3.3-rack-2.2 | 2.2.23-r0 |
| Wolfi | ruby3.4-rack-2.2 | 2.2.23-r0 |
| Wolfi | ruby4.0-rack-2.2 | 2.2.23-r0 |
| openSUSE Leap 16.0 | rmt-server | 3.1.0-160000.1.1 |
| openSUSE Tumbleweed | rubygem-rack-2.2 | 2.2.23-1.1 |