Detections
Analytics
CVE-2026-125108
low
Description
Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parse_boundary can skip a leading empty or quoted boundary parameter in a multipart Content-Type header and accept a later parameter. Rack can therefore parse a request body with a boundary that a conforming intermediary would not derive, allowing form fields or file uploads to reach an application without the intended proxy or web application firewall inspection. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8.
References
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/GHSA-p8x9-v4hv-2w4g.yml
https://github.com/rack/rack/security/advisories/GHSA-p8x9-v4hv-2w4g
https://github.com/rack/rack/releases/tag/v3.2.8
https://github.com/rack/rack/releases/tag/v3.1.23
https://github.com/rack/rack/releases/tag/v2.2.25
https://github.com/rack/rack/commit/d5e928b803da30b8e40171dbd4be39bed7daa6fa
https://github.com/rack/rack/commit/a29512324265790a5536b830490075d0d79323be
https://github.com/rack/rack/commit/19a1a19cb4da97d61c8d5effeb2e927c44370ae9