Vulnerability · Published Apr 2, 2026 · Assigned by GitHub_M

CVE-2026-34827Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser

High 7.5

In plain English

A high-severity uncontrolled resource consumption in rack from rack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 57.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Multipart::Parser#handle_mime_head parses quoted multipart parameters such as Content-Disposition: form-data; name="..." using repeated String#index searches combined with String#slice! prefix deletion. For escape-heavy quoted values, this causes super-linear processing. An unauthenticated attacker can send a crafted multipart/form-data request containing many parts with long backslash-escaped parameter values to trigger excessive CPU usage during multipart parsing. This results in a denial of service condition in Rack applications that accept multipart form data. This issue has been patched in versions 3.1.21 and 3.2.6.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	ruby-rack	3.1.20-0+deb13u2	DEBIAN-CVE-2026-34827
Debian:14	ruby-rack	3.2.6-2	DEBIAN-CVE-2026-34827
RubyGems	rack	3.1.21	GHSA-v6x5-cg8r-vv6x
RubyGems	rack	3.2.6	GHSA-v6x5-cg8r-vv6x
Ubuntu:22.04:LTS	ruby-rack	no fix listed	UBUNTU-CVE-2026-34827
Ubuntu:24.04:LTS	ruby-rack	no fix listed	UBUNTU-CVE-2026-34827
Ubuntu:25.10	ruby-rack	3.1.16-0.1ubuntu0.3	UBUNTU-CVE-2026-34827
Ubuntu:26.04:LTS	ruby-rack	3.2.4-1ubuntu1.1	UBUNTU-CVE-2026-34827
Ubuntu:26.04:LTS	ruby-rack	3.2.4-1ubuntu1.1	USN-8989-1

Affected products (as reported)

Vendor	Product	Versions
rack	rack	>= 3.0.0.beta1, < 3.1.21>= 3.2.0, < 3.2.6

Weakness: CWE-407, CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/rack/rack/security/advisories/GHSA-v6x5-cg8r-vv6x x_refsource_CONFIRM
https://access.redhat.com/security/cve/CVE-2026-34827 vdb-entry, x_refsource_REDHAT
RHBZ#2454501 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34827.json x_sadp-csaf-vex