CVE-2026-26962

Executive Summary

CVE-2026-26962 is a medium-severity vulnerability in the Rack Ruby web server interface, specifically within the Rack::Multipart::Parser component. The flaw arises from improper handling of folded multipart headers (obs-fold sequences). When a multipart header contains an obs-fold (a line break continuation), Rack preserves the embedded CRLF characters in parsed parameter values like filename or name instead of removing them during unfolding. This can lead to downstream HTTP response splitting or header injection if applications reuse these parsed values in HTTP response headers. The vulnerability affects Rack versions from 3.2.0 to before 3.2.6. A patch is available in version 3.2.6.

Supply Chain & Package Security

This vulnerability affects the Rack gem, a critical component of the Ruby ecosystem. Rack is a dependency for many Ruby web frameworks, including Ruby on Rails, Sinatra, and others. The flaw is in the multipart parser, which is commonly used for file uploads and form data processing. Organizations using Rack should prioritize patching to prevent potential supply chain attacks where malicious multipart data could be used to inject headers into HTTP responses.

CVSS Breakdown & Threat Level

• CVSS Score: 4.8 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The threat level is medium due to the low complexity and network-based attack vector, but the impact is limited to integrity (header injection) without affecting confidentiality or availability.

Deep Dive & Mechanics

The vulnerability is in the Rack::Multipart::Parser class, which handles parsing of multipart form data (e.g., file uploads). In HTTP, multipart headers can be "folded" using obs-fold sequences (obsolete line folding), where a header line is continued on the next line by starting with a space or tab. According to RFC 7230, these folded lines should be "unfolded" by removing the CRLF and any leading whitespace. However, Rack's parser incorrectly preserves the CRLF characters in the parsed parameter values.

For example, a multipart header like:

Content-Disposition: form-data; name="file"; filename="test
 file.txt"

would be parsed with the filename containing an embedded CRLF, resulting in "test\r\n file.txt". If this value is later used in an HTTP response header (e.g., Content-Disposition: attachment; filename="test\r\n file.txt"), the CRLF can be interpreted as a header separator, allowing an attacker to inject arbitrary headers or split the response.

The vulnerability is specific to the Rack::Multipart::Parser and does not affect other parts of Rack. The fix in version 3.2.6 properly unfolds obs-fold sequences by removing the CRLF and leading whitespace.

Vulnerable vs. Patched Code

Vulnerable Code (Rack < 3.2.6):

# In Rack::Multipart::Parser, the parsing of multipart headers does not unfold obs-fold sequences.
# The value is taken as-is, including CRLF characters.
def parse_headers(part)
  # ...
  value = header_value.strip
  # No unfolding of obs-fold
  # ...
end

Patched Code (Rack >= 3.2.6):

# In Rack::Multipart::Parser, the parsing now unfolds obs-fold sequences.
def parse_headers(part)
  # ...
  value = header_value.gsub(/\r\n[ \t]+/, ' ').strip
  # Properly unfolds obs-fold by replacing CRLF+whitespace with a single space
  # ...
end

The key difference is the addition of gsub(/\r\n[ \t]+/, ' ') to remove the folded line breaks.

Exploitation & Lab Setup

Red Team (Attack Simulation)

To exploit this vulnerability, an attacker would craft a multipart request with a folded header containing a CRLF injection payload. For example, using curl:

curl -X POST http://target.com/upload \
  -H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundary" \
  --data-binary $'------WebKitFormBoundary\r\nContent-Disposition: form-data; name="file"; filename="test\r\nInjected-Header: malicious"\r\n\r\nfile content\r\n------WebKitFormBoundary--\r\n'

If the application uses the filename in a response header (e.g., Content-Disposition), the injected header will be added to the response, potentially allowing for response splitting or header injection.

Blue Team (Defense & Detection)

Defenders should:

1. Patch immediately to Rack version 3.2.6 or later.
2. Monitor for unusual multipart requests with folded headers or CRLF sequences in parameter values.
3. Validate and sanitize any user-supplied data used in HTTP response headers.
4. Use WAF rules to block requests with obs-fold sequences in multipart headers.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with multipart headers containing CRLF sequences (e.g., \r\n in header values).
  • Responses with unexpected headers or multiple Content-Disposition headers.
• Log IOCs:
  • Application logs showing multipart parsing errors or warnings.
  • Web server logs with unusual multipart boundary patterns.
• File IOCs:
  • Temporary files created by Rack's multipart parser with unusual filenames containing CRLF.

Detection Engineering

YARA Rule

rule CVE_2026_26962_Rack_Multipart_Header_Injection {
    meta:
        description = "Detects attempts to exploit CVE-2026-26962 via folded multipart headers"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-26962"
    strings:
        $crlf = /\r\n[ \t]+/
        $multipart = /Content-Disposition: form-data/
    condition:
        $multipart and #crlf > 0
}

Sigma Rule

title: CVE-2026-26962 - Rack Multipart Header Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with folded multipart headers indicating exploitation of CVE-2026-26962
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'multipart/form-data'
        cs(User-Agent)|contains: 'curl'
    condition: selection
falsepositives:
    - Legitimate use of folded headers in some applications
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-26962 - Rack Multipart Header Injection Attempt"; flow:to_server; content:"Content-Disposition"; http_header; pcre:"/\\r\\n[ \\t]+/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade Rack to version 3.2.6 or later. This is the primary fix.
2. Input Validation: Sanitize all user-supplied data used in HTTP response headers, especially filenames from multipart uploads.
3. WAF Rules: Deploy web application firewall rules to block requests with obs-fold sequences in multipart headers.
4. Monitoring: Enable logging and monitoring for unusual multipart requests and response headers.
5. Code Review: Review application code that uses Rack's multipart parser to ensure parsed values are properly sanitized before being used in headers.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 67A670A4B72413CD9B8341E1] */}