CVE-2026-26961
Publication date 2 April 2026
Last updated 23 April 2026
Ubuntu priority
Description
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| ruby-rack | 26.04 LTS resolute |
Vulnerable
|
| 25.10 questing |
Fixed 3.1.16-0.1ubuntu0.3
|
|
| 24.04 LTS noble |
Fixed 2.2.7-1ubuntu0.7
|
|
| 22.04 LTS jammy |
Fixed 2.1.4-5ubuntu1.2+esm3
|
|
| 20.04 LTS focal |
Fixed 2.0.7-2ubuntu0.1+esm10
|
|
| 18.04 LTS bionic | Ignored changes too intrusive | |
| 16.04 LTS xenial | Ignored changes too intrusive | |
| 14.04 LTS trusty | Ignored changes too intrusive |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
| Parameter | Value |
|---|---|
| Base score |
3.7 · Low
|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | Low |
| Availability impact | None |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-8182-1
- Rack vulnerabilities
- 17 April 2026