CVE-2026-26962: Rack Header Injection Vulnerability

CVE-2026-26962 Overview

CVE-2026-26962 is a header injection vulnerability affecting Rack, the modular Ruby web server interface widely used across Ruby on Rails and other Ruby-based web applications. The vulnerability exists in the Rack::Multipart::Parser component, which incorrectly handles folded multipart part headers. When a multipart header contains an obs-fold sequence (obsolete line folding), Rack preserves embedded CRLF characters in parsed parameter values such as filename or name instead of properly removing the folded line break during the unfolding process. This flaw can enable downstream HTTP header injection or response splitting attacks when applications reuse these parsed values in HTTP response headers.

Critical Impact

Applications that pass user-controlled multipart header values into HTTP responses may be vulnerable to header injection attacks, potentially enabling response splitting, cache poisoning, or cross-site scripting through injected headers.

Affected Products

• Rack versions 3.2.0 through 3.2.5
• Ruby web applications using affected Rack versions with multipart form handling
• Rails applications and other Ruby frameworks depending on vulnerable Rack releases

Discovery Timeline

• 2026-04-02 - CVE CVE-2026-26962 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-26962

Vulnerability Analysis

This vulnerability is classified as CWE-93 (Improper Neutralization of CRLF Sequences), commonly known as CRLF Injection or HTTP Response Splitting. The root issue lies in how Rack::Multipart::Parser processes multipart form data headers that contain obsolete folding (obs-fold) sequences as defined in RFC 7230.

HTTP headers historically allowed long header values to be "folded" across multiple lines by inserting a CRLF followed by at least one space or horizontal tab. While this practice is deprecated, parsers must still handle these sequences for compatibility. The correct behavior is to unfold these sequences by replacing the CRLF and following whitespace with a single space character.

However, Rack's multipart parser fails to properly unfold these sequences. Instead of stripping the CRLF characters during the unfolding process, it preserves them within the parsed parameter values. When an application subsequently uses these values—such as a filename from a file upload—in constructing HTTP response headers, the preserved CRLF characters can break out of the intended header context.

An attacker can craft malicious multipart requests with obs-fold sequences containing CRLF characters followed by arbitrary header content. If the application echoes the parsed filename or other parameter in a response header (e.g., Content-Disposition for file downloads), the injected CRLF terminates that header and allows injection of additional headers or even a complete HTTP response body.

Root Cause

The vulnerability stems from improper implementation of the header unfolding algorithm in Rack::Multipart::Parser. The parser recognizes obs-fold sequences but fails to properly sanitize them by removing the embedded CRLF characters. According to HTTP specifications, when unfolding obsolete line folding, the CRLF and subsequent whitespace should be replaced with a single space. Rack's implementation preserves the raw CRLF bytes, creating an injection vector when these values are reused in HTTP contexts.

Attack Vector

The attack vector is network-based and requires an attacker to send a specially crafted multipart HTTP request to a vulnerable application. The attack complexity is considered high because successful exploitation depends on how the target application handles parsed multipart values. Specifically, the application must:

1. Accept multipart form data using the vulnerable Rack versions
2. Extract parameter values (such as filename) from the parsed multipart data
3. Include those values in HTTP response headers without additional sanitization

The vulnerability mechanism involves embedding CRLF sequences within obs-fold patterns in multipart Content-Disposition headers. When Rack parses the multipart request, it incorrectly preserves these CRLF sequences. If the application then uses the parsed filename in a response header—a common pattern for file download functionality—the attacker-controlled CRLF can inject arbitrary headers or split the HTTP response.

For detailed technical information and proof-of-concept examples, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-26962

Indicators of Compromise

• Unusual multipart form submissions containing obs-fold sequences (CRLF followed by whitespace) in header values
• HTTP response headers containing unexpected line breaks or additional injected headers
• Application logs showing malformed Content-Disposition or other multipart header values with embedded control characters
• Evidence of cache poisoning or XSS attacks originating from file upload functionality

Detection Strategies

• Monitor web application firewall (WAF) logs for multipart requests containing CRLF sequences (0x0D 0x0A) within header parameter values
• Implement request inspection rules to detect obs-fold patterns in multipart Content-Disposition headers
• Review application code for patterns where multipart-parsed values (especially filename) are used in response headers
• Use static analysis tools to identify code paths that pass user-controlled input to HTTP header construction methods

Monitoring Recommendations

• Enable detailed logging for multipart form processing in Ruby web applications
• Configure intrusion detection systems to alert on HTTP requests with unusual control characters in multipart boundaries
• Monitor for anomalous HTTP responses that contain more headers than expected or unexpected Set-Cookie headers
• Implement response header validation to detect injected content before responses are sent to clients

How to Mitigate CVE-2026-26962

Immediate Actions Required

• Upgrade Rack to version 3.2.6 or later immediately
• Audit application code to identify locations where multipart-parsed values are used in HTTP response headers
• Implement additional sanitization for any user-controlled values included in response headers
• Consider using Content Security Policy headers to mitigate potential XSS from header injection

Patch Information

The vulnerability has been patched in Rack version 3.2.6. The fix properly implements the obs-fold unfolding algorithm by stripping CRLF sequences from multipart header parameter values during parsing. Organizations should update their Gemfile to specify the patched version and run bundle update rack to apply the fix.

For applications using Rails or other frameworks that bundle Rack, ensure the framework's dependency resolution pulls in Rack 3.2.6 or later. Review the GitHub Security Advisory for additional details on the patch.

Workarounds

• If immediate upgrade is not possible, implement middleware to sanitize multipart-parsed values before they reach application code
• Add response header validation that strips or rejects values containing CRLF sequences before setting headers
• Use allow-listing for acceptable characters in filename and other multipart parameters
• Configure reverse proxies or WAFs to normalize or reject requests with obs-fold sequences in multipart headers

# Update Rack to patched version
bundle update rack

# Verify installed version is 3.2.6 or later
bundle show rack
# Expected output: rack (3.2.6) or higher

# Alternative: Pin specific version in Gemfile
echo "gem 'rack', '>= 3.2.6'" >> Gemfile
bundle install