CVE-2026-125108

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.25 Rack versions prior to 3.1.23 Rack versions prior to 3.2.8

Description The Rack::Multipart::Parser.parse boundary() function can skip a leading empty or quoted boundary parameter in a multipart Content-Type header and accept a subsequent parameter. This behavior allows the software to parse a request body with a boundary that a conforming intermediary would not derive, potentially enabling form fields or file uploads to bypass inspection by a proxy or web application firewall.

Recommendations Update to version 2.2.25 Update to version 3.1.23 Update to version 3.2.8