CVE-2026-26962
Fixed in a distro release EPSS <1%CVSS 4.8
Rack is a modular Ruby web server interface. From version 3.2.0 to before version 3.2.6, Rack::Multipart::Parser unfolds folded multipart part headers incorrectly. When a multipart header contains an obs-fold sequence, Rack preserves the embedded CRLF in parsed parameter values such as filename or name instead of removing the folded line break during unfolding. As a result, applications that later reuse those parsed values in HTTP response headers may be vulnerable to downstream header injection or response splitting. This issue has been patched in version 3.2.6.
Products: Rack
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | rack | 3.2.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | pact-broker-docker | 2.137.0.2.118.0-r4 |
| Chainguard | pact-broker-docker-fips | 2.137.0.2.118.0-r2 |
| Chainguard | ruby3.2-rails-7.2 | 7.2.3.1-r1 |
| Chainguard | ruby3.2-rails-7.2 | 7.2.3.1-r2 |
| Chainguard | ruby3.2-rails-8.0 | 8.0.5-r0 |
| Chainguard | ruby3.4-rails-7.2 | 7.2.3.1-r1 |
| Chainguard | ruby3.4-rails-8.0 | 8.0.5-r1 |
| Chainguard | ruby3.4-rails-8.0 | 8.0.5-r2 |
| Debian 13 | ruby-rack | 3.1.20-0+deb13u2 |
| Debian 14 | ruby-rack | 3.2.6-2 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP6 | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Server 16.0 | rmt-server | 3.1.0-160000.1.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | rmt-server | 2.27-150500.3.47.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | rmt-server | 3.1.0-160000.1.1 |
| Ubuntu 22.04 LTS | ruby-rack | no fix |
| Ubuntu 24.04 LTS | ruby-rack | 2.2.7-1ubuntu0.7 |
| Ubuntu 25.10 | ruby-rack | 3.1.16-0.1ubuntu0.3 |
| Ubuntu 26.04 LTS | ruby-rack | no fix |
| Ubuntu Pro 14.04 LTS | ruby-rack | 1.5.2-3+deb8u3ubuntu1~esm11 |
| Ubuntu Pro 14.04 LTS | ruby-rack | no fix |
| Ubuntu Pro 16.04 LTS | ruby-rack | no fix |
| Ubuntu Pro 16.04 LTS | ruby-rack | 1.6.4-3ubuntu0.2+esm10 |
| Ubuntu Pro 18.04 LTS | ruby-rack | no fix |
| Ubuntu Pro 18.04 LTS | ruby-rack | 1.6.4-4ubuntu0.2+esm10 |
| Ubuntu Pro 20.04 LTS | ruby-rack | no fix |
| Ubuntu Pro 20.04 LTS | ruby-rack | 2.0.7-2ubuntu0.1+esm10 |
| Ubuntu Pro 22.04 LTS | ruby-rack | 2.1.4-5ubuntu1.2+esm3 |
| Wolfi | ruby3.2-rails-8.0 | 8.0.5-r0 |
| Wolfi | ruby3.4-rails-8.0 | 8.0.5-r2 |
| openSUSE Leap 16.0 | rmt-server | 3.1.0-160000.1.1 |