CVE-2026-125108— Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass

Quick assessment

Affected

rack rack

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Rack 是一个模块化的 Ruby Web 服务器接口。在 2.2.25、3.1.23 和 3.2.8 之前的版本中，方法会跳过 multipart Content-Type 头部中前导的空边界参数或带引号的边界参数，并转而接受后续的参数。因此，Rack 能够解析出一种边界值，而符合标准的中间代理设备无法推导出该边界值。这导致表单字段或文件上传可绕过预期的代理服务器或 Web 应用防火墙（WAF）的审查，直接到达应用程序。该问题已在 2.2.25、3.1.23 和 3.2.8 版本中修复。

CVSS 3.7 · Low Updated Nov 10, 2026

Possible ATT&CK Techniques 2 AI

T1055 · Process Injection T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass

Source: CVE Program / CVE List V5

Vulnerability Description

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parse_boundary can skip a leading empty or quoted boundary parameter in a multipart Content-Type header and accept a later parameter. Rack can therefore parse a request body with a boundary that a conforming intermediary would not derive, allowing form fields or file uploads to reach an application without the intended proxy or web application firewall inspection. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

解释冲突

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
rack	rack	< 2.2.25	-

II. Public POCs for CVE-2026-125108

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-125108

请登录查看更多情报信息。

Other References for CVE-2026-125108 (7)

https://github.com/rack/rack/releases/tag/v3.2.8 x_refsource_MISC
https://github.com/rack/rack/releases/tag/v3.1.23 x_refsource_MISC
https://github.com/rack/rack/releases/tag/v2.2.25 x_refsource_MISC
https://github.com/rack/rack/security/advisories/GHSA-p8x9-v4hv-2w4g x_refsource_CONFIRM
https://github.com/rack/rack/commit/19a1a19cb4da97d61c8d5effeb2e927c44370ae9 x_refsource_MISC
https://github.com/rack/rack/commit/d5e928b803da30b8e40171dbd4be39bed7daa6fa x_refsource_MISC
https://github.com/rack/rack/commit/a29512324265790a5536b830490075d0d79323be x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-125108

Same Patch Batch · rack · 2026-11-09 · 4 CVEs total

CVE-2026-125111	7.5 HIGH	Rack: Multipart parsing allows DoS via unbounded scan buffer growth
CVE-2026-125110	5.3 MEDIUM	Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch
CVE-2026-125109	4.8 MEDIUM	Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host head

IV. Related Vulnerabilities

Same product: rack

Same vendor: rack

Same weakness: CWE-436