CVE-2026-26961: Rack Multipart Smuggling Vulnerability

CVE-2026-26961 Overview

CVE-2026-26961 is a HTTP Request Smuggling vulnerability in Rack, a modular Ruby web server interface. The vulnerability exists in Rack::Multipart::Parser, which extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated.

Critical Impact

Attackers can bypass WAF and proxy validation by exploiting boundary parameter interpretation differences, potentially smuggling malicious payloads past security controls.

Affected Products

• Rack versions prior to 2.2.23
• Rack versions prior to 3.1.21
• Rack versions prior to 3.2.6

Discovery Timeline

• 2026-04-02 - CVE CVE-2026-26961 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-26961

Vulnerability Analysis

This vulnerability stems from how Rack::Multipart::Parser processes boundary parameters in multipart form data. The parser uses a greedy regular expression pattern that, when encountering multiple boundary parameters in a single Content-Type header, extracts the last occurrence rather than the first. This behavior deviates from how many upstream security devices (proxies, WAFs, and other intermediaries) interpret the same header, creating a parsing differential that attackers can exploit.

The attack enables content smuggling where the security intermediary validates one interpretation of the multipart body while Rack processes an entirely different structure. This parsing mismatch is classified under CWE-436 (Interpretation Conflict), representing a fundamental disagreement between components about how to interpret the same data.

Root Cause

The root cause is the use of a greedy regular expression in Rack::Multipart::Parser for extracting the boundary parameter from the Content-Type header. When multiple boundary= directives are present, the regex captures the last match instead of the first. Since RFC specifications and common implementations typically use the first occurrence, this creates an exploitable interpretation conflict with upstream systems.

Attack Vector

The attack requires network access and exploits the interpretation conflict between Rack and upstream security infrastructure. An attacker crafts a malicious HTTP request with a Content-Type header containing multiple boundary parameters. The upstream WAF or proxy validates the request body using the first boundary parameter, while Rack parses the body using the last boundary parameter. This allows attackers to include payloads that appear benign to the WAF but contain malicious content when processed by the Ruby application.

The vulnerability is exploited by sending specially crafted multipart/form-data requests where the Content-Type header includes multiple boundary parameters. Security intermediaries validate the first boundary interpretation while Rack processes content delimited by the last boundary, allowing malicious payloads to bypass inspection. See the GitHub Security Advisory for additional technical details.

Detection Methods for CVE-2026-26961

Indicators of Compromise

• HTTP requests with multiple boundary= parameters in the Content-Type header
• Unusual multipart form data that fails WAF validation but succeeds at the application layer
• Web server logs showing discrepancies between proxy-logged content and application-received data
• Increased error rates or unexpected behavior in multipart file upload processing

Detection Strategies

• Configure WAF rules to detect and block Content-Type headers containing multiple boundary parameters
• Implement request correlation monitoring between upstream proxies and application servers to identify parsing discrepancies
• Deploy SentinelOne Singularity Platform to monitor Ruby application behavior for anomalous request processing patterns
• Create custom detection rules for HTTP headers with duplicate parameter names in multipart requests

Monitoring Recommendations

• Enable verbose logging for multipart form processing in Rack-based applications
• Monitor for requests where the Content-Type header length exceeds typical values
• Set up alerts for boundary parameter anomalies in web server access logs
• Implement application-layer monitoring to detect payload mismatches between security layer validation and actual processing

How to Mitigate CVE-2026-26961

Immediate Actions Required

• Upgrade Rack to version 2.2.23, 3.1.21, or 3.2.6 depending on your current major version
• Audit upstream proxy and WAF configurations to ensure they reject requests with multiple boundary parameters
• Review application logs for any historical evidence of exploitation attempts
• Ensure all Ruby web applications in your environment have their Rack dependency updated

Patch Information

The vulnerability has been patched in Rack versions 2.2.23, 3.1.21, and 3.2.6. Organizations should update their Rack gem dependency to the appropriate patched version based on their current major version branch. The fix ensures consistent boundary parameter extraction that aligns with upstream security device interpretation. For complete details, refer to the GitHub Security Advisory.

Workarounds

• Configure upstream proxies to reject requests containing multiple boundary= parameters in the Content-Type header
• Implement custom middleware to validate and normalize multipart boundary parameters before Rack processing
• Deploy WAF rules to detect and block potentially malicious multipart request patterns
• Consider restricting multipart form uploads to authenticated users only where possible

# Update Rack to patched version via Bundler
bundle update rack

# Verify installed Rack version is patched
bundle show rack

# For Rack 2.x series, ensure version >= 2.2.23
# For Rack 3.1.x series, ensure version >= 3.1.21
# For Rack 3.2.x series, ensure version >= 3.2.6