CVE catalog

CVE-2026-26961

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expres

[CVE catalog]

Severity
Low · CVSS 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.25% · Oct 25, 2026

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-racksid3.2.7-1fixed
Debianruby-rackforky3.2.7-1fixed
Debianruby-racktrixie3.1.20-0+deb13u1vulnerable
Debianruby-racktrixie-security3.1.20-0+deb13u2fixed
Debianruby-rackbookworm2.2.22-0+deb12u1vulnerable
Debianruby-rackbookworm-security2.2.22-0+deb12u2fixed
Cperuby-rackNot reported2.2.7-1ubuntu0.7fixed
Cperuby-rackNot reportedNot reportedvulnerable
CperackNot reported2.2.23fixed
CperackNot reported3.1.21fixed
CperackNot reported3.2.6fixed
Susermt-serverlinux enterprise server 16.03.1.0-160000.1.1fixed
Susermt-serverlinux enterprise server for sap applications 16.03.1.0-160000.1.1fixed
Opensusermt-serverleap 16.03.1.0-160000.1.1fixed
Ubunturuby-rackpro2.1.4-3vulnerable
Ubunturuby-rackpro2.1.4-4vulnerable
Ubunturuby-rackpro2.1.4-5vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm2vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm3vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm4vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm5vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.1vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.1+esm1vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.1+esm2vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.2vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.2+esm1vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.2+esm2vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.2+esm3fixed
Ubunturuby-rack24.042.2.4-3vulnerable
Ubunturuby-rack24.042.2.7-1vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.1vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.2vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.3vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.4vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.5vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.6vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.7fixed
Ubunturuby-rack25.102.2.7-1.1vulnerable
Ubunturuby-rack25.103.1.16-0.1vulnerable
Ubunturuby-rack25.103.1.16-0.1ubuntu0.1vulnerable
Ubunturuby-rack25.103.1.16-0.1ubuntu0.2vulnerable
Ubunturuby-rack25.103.1.16-0.1ubuntu0.3fixed
Susermt-serverlinux enterprise module for public cloud 15 sp52.27-150500.3.47.1fixed
Susermt-serverlinux enterprise module for public cloud 15 sp62.27-150500.3.47.1fixed
Susermt-serverlinux enterprise high performance computing 15 sp5-espos2.27-150500.3.47.1fixed
Susermt-serverlinux enterprise high performance computing 15 sp5-ltss2.27-150500.3.47.1fixed
Susermt-serverlinux enterprise server 15 sp5-ltss2.27-150500.3.47.1fixed
Susermt-serverlinux enterprise server 15 sp6-ltss2.27-150500.3.47.1fixed
Susermt-serverlinux enterprise server for sap applications 15 sp52.27-150500.3.47.1fixed
Susermt-serverlinux enterprise server for sap applications 15 sp62.27-150500.3.47.1fixed
Opensuserubygem-rack-2.2tumbleweed2.2.23-1.1fixed
Ubunturuby-rackpro2.1.4-3vulnerable
Ubunturuby-rackpro2.1.4-4vulnerable
Ubunturuby-rackpro2.1.4-5vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm2vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm3vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm4vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm5vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.1vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.1+esm1vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.1+esm2vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.2vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.2+esm1vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.2+esm2vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1.2+esm3fixed
Ubunturuby-rack24.042.2.4-3vulnerable
Ubunturuby-rack24.042.2.7-1vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.1vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.2vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.3vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.4vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.5vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.6vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.7fixed
Ubunturuby-rack25.102.2.7-1.1vulnerable
Ubunturuby-rack25.103.1.16-0.1vulnerable
Ubunturuby-rack25.103.1.16-0.1ubuntu0.1vulnerable
Ubunturuby-rack25.103.1.16-0.1ubuntu0.2vulnerable
Ubunturuby-rack25.103.1.16-0.1ubuntu0.3fixed
Ubunturuby-rack26.043.1.16-0.1vulnerable
Ubunturuby-rack26.043.1.18-1vulnerable
Ubunturuby-rack26.043.1.18-1build1vulnerable
Ubunturuby-rack26.043.2.4-1ubuntu1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-racksourcesid3.2.6-2not yet assignedNot reportedNot reported
Debianruby-racksourceforky3.2.6-2not yet assignedNot reportedNot reported
Debianruby-racksourcetrixie3.1.20-0+deb13u2not yet assignedNot reportedNot reported
Debianruby-racksourcebookworm2.2.22-0+deb12u2not yet assignedNot reportedNot reported
Cperuby-rackcpeNot reported2.2.7-1ubuntu0.7Not reportedNot reportedNot reported
CperackcpeNot reported2.2.23Not reportedNot reportedNot reported
CperackcpeNot reported3.1.21Not reportedNot reportedNot reported
CperackcpeNot reported3.2.6Not reportedNot reportedNot reported
Susermt-serverrpmlinux enterprise server 16.03.1.0-160000.1.1Not reportedSUSE-SU-2026:23321-1Not reported
Susermt-serverrpmlinux enterprise server for sap applications 16.03.1.0-160000.1.1Not reportedSUSE-SU-2026:23321-1Not reported
Opensusermt-serverrpmleap 16.03.1.0-160000.1.1Not reportedOPENSUSE-SU-2026:21640-1Not reported
Ubunturuby-rackdebpro2.1.4-5ubuntu1.2+esm3Not reportedUSN-8182-1Not reported
Ubunturuby-rackdeb24.042.2.7-1ubuntu0.7Not reportedUSN-8182-1Not reported
Ubunturuby-rackdeb25.103.1.16-0.1ubuntu0.3Not reportedUSN-8182-1Not reported
Susermt-serverrpmlinux enterprise module for public cloud 15 sp52.27-150500.3.47.1Not reportedSUSE-SU-2026:2487-1Not reported
Susermt-serverrpmlinux enterprise module for public cloud 15 sp62.27-150500.3.47.1Not reportedSUSE-SU-2026:2487-1Not reported
Susermt-serverrpmlinux enterprise high performance computing 15 sp5-espos2.27-150500.3.47.1Not reportedSUSE-SU-2026:2487-1Not reported
Susermt-serverrpmlinux enterprise high performance computing 15 sp5-ltss2.27-150500.3.47.1Not reportedSUSE-SU-2026:2487-1Not reported
Susermt-serverrpmlinux enterprise server 15 sp5-ltss2.27-150500.3.47.1Not reportedSUSE-SU-2026:2487-1Not reported
Susermt-serverrpmlinux enterprise server 15 sp6-ltss2.27-150500.3.47.1Not reportedSUSE-SU-2026:2487-1Not reported
Susermt-serverrpmlinux enterprise server for sap applications 15 sp52.27-150500.3.47.1Not reportedSUSE-SU-2026:2487-1Not reported
Susermt-serverrpmlinux enterprise server for sap applications 15 sp62.27-150500.3.47.1Not reportedSUSE-SU-2026:2487-1Not reported
Opensuserubygem-rack-2.2rpmtumbleweed2.2.23-1.1Not reportedOPENSUSE-SU-2026:10508-1Not reported
Ubunturuby-rackdebpro2.1.4-5ubuntu1.2+esm3Not reportedUBUNTU-CVE-2026-26961Not reported
Ubunturuby-rackdeb24.042.2.7-1ubuntu0.7Not reportedUBUNTU-CVE-2026-26961Not reported
Ubunturuby-rackdeb25.103.1.16-0.1ubuntu0.3Not reportedUBUNTU-CVE-2026-26961Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ruby-rack]Affected
    Details (4)

    • 2.2.22-0+deb12u1 · all · bookworm

      Affected · Fixed: 2.2.22-0+deb12u2

      nvd · ruby-rack · debian · bookworm; nvd · ruby-rack · debian · 12

    • 2.2.22-0+deb12u1 · all · bookworm

      Affected · Fixed: 2.2.22-0+deb12u2

      nvd · ruby-rack · debian · bookworm; nvd · ruby-rack · debian · 12

    • 2.2.22-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 2.2.22-0+deb12u2

      nvd · ruby-rack · debian · bookworm; nvd · ruby-rack · debian · 12

    • 2.2.22-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 2.2.22-0+deb12u2

      nvd · ruby-rack · debian · bookworm; nvd · ruby-rack · debian · 12

[Debian 13 (Trixie)]

  • [ruby-rack]Affected
    Details (5)

    • 3.1.20-0+deb13u1 · all · trixie

      Affected · Fixed: 3.1.20-0+deb13u2

      nvd · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie

      Affected · Fixed: 3.1.20-0+deb13u2

      nvd · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie-security

      Affected · Fixed: 3.1.20-0+deb13u2

      nvd · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie-security · Historical version

      Affected · Fixed: 3.1.20-0+deb13u2

      nvd · ruby-rack · debian · 13

    • 3.1.20-0+deb13u2 · all · trixie-security

      Fixed · Fixed: 3.1.20-0+deb13u2

      nvd · ruby-rack · debian · 13

[openSUSE Tumbleweed]

  • [ruby4.0-rubygem-rack-2.2]Unknown

    Source package: [rubygem-rack-2.2]

    Details (1)

    • 2.2.23-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.2.23-1.1

      Version impact unknown

      nvd · rubygem-rack-2.2 · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]