---
id: "CVE-2026-125108"
page: "https://infrastack.ai/live/CVE-2026-125108"
kind: "vulnerability"
aliases: ["CVE-2026-125108", "GHSA-p8x9-v4hv-2w4g"]
title: "Multipart boundary guard skips a leading empty or quoted `boundary` parameter, allowing parser differentials and WAF bypass."
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "rack", "fixed": ["2.2.25"], "affected": "< 2.2.25", "ecosystem": "rubygems"}, {"name": "rack", "fixed": ["3.1.23"], "affected": ">= 3.0, < 3.1.23", "ecosystem": "rubygems"}, {"name": "rack", "fixed": ["3.2.8"], "affected": ">= 3.2, < 3.2.8", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["cwe-436", "package", "rack", "rails", "ruby", "self-hosted"]
not_affected_if: ["no-waf-in-front", "proxy-rejects-multiple-boundaries"]
published_at: "2026-10-30T02:19:00+00:00"
first_seen_at: "2026-11-09T22:53:30+00:00"
updated_at: "2026-11-09T22:57:20+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/rack/rack/security/advisories/GHSA-p8x9-v4hv-2w4g", "first_seen_at": "2026-11-09T22:53:30+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125108", "first_seen_at": "2026-11-10T00:28:47+00:00"}]
exploit_sources: []
---

# Multipart boundary guard skips a leading empty or quoted `boundary` parameter, allowing parser differentials and WAF bypass.

Link for people: https://infrastack.ai/live/CVE-2026-125108 (this .md is for agents)

Rack's guard against multipart requests with two boundary parameters misses a Content-Type whose first boundary is empty or starts with a quote, semicolon or comma. An attacker can send a body that a web application firewall reads differently from Rack, so uploads and form fields reach the app without inspection.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:rack affected < 2.2.25 fixed 2.2.25
- rubygems:rack affected >= 3.0, < 3.1.23 fixed 3.1.23
- rubygems:rack affected >= 3.2, < 3.2.8 fixed 3.2.8

## How to check

- Check the Rack version in `Gemfile.lock` for `rack (`
- Run `bundle exec ruby -e 'require "rack"; puts Rack.release'` to print the loaded version
- Look for a WAF or inspecting proxy in front of the Rack app that filters multipart uploads

## Fix

- `rack` 2.2 line: `2.2.25`
- `rack` 3.1 line: `3.1.23`
- `rack` 3.2 line: `3.2.8`

## Timeline

- 2026-11-09T22:53:30+00:00 ghsa-repo https://github.com/rack/rack/security/advisories/GHSA-p8x9-v4hv-2w4g
- 2026-11-10T00:28:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125108

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/rack/rack/security/advisories/GHSA-p8x9-v4hv-2w4g
- [fix] Patch: github.com https://github.com/rack/rack/commit/a29512324265790a5536b830490075d0d79323be
- [fix] Patch: github.com https://github.com/rack/rack/commit/d5e928b803da30b8e40171dbd4be39bed7daa6fa
- [fix] Patch: github.com https://github.com/rack/rack/commit/19a1a19cb4da97d61c8d5effeb2e927c44370ae9
- [fix] Release notes: github.com https://github.com/rack/rack/releases/tag/v3.1.23
- [fix] Release notes: github.com https://github.com/rack/rack/releases/tag/v3.2.8
- [fix] Release notes: github.com https://github.com/rack/rack/releases/tag/v2.2.25

## From the sources

## Summary

The guard added for CVE-2026-26961 (GHSA-vgpv-f759-9wx3), which rejects multipart requests with more than one `boundary` parameter, only inspects the part of the `Content-Type` header after the boundary it extracts. A `Content-Type` whose first `boundary` parameter is empty or begins with a quote, semicolon, or comma is skipped by the extraction pattern, so a second `boundary` parameter is accepted silently and Rack parses the body with a boundary that a conforming parser would not derive from the header.

## Details

`Rack::Multipart::Parser.parse_boundary` extracts the boundary with a regular expression that uses a lazy prefix and a value class excluding `"`, `;`, and `,`. For a header such as `multipart/form-data; boundary=";boundary=AaB03x"` or `multipart/form-data; boundary=; boundary=AaB03x`, the pattern skips the first `boundary=` and anchors on the second, and the subsequent check for another `boundary=` in the remaining text finds nothing. Rack then uses `AaB03x`.

RFC 9110 parses the first header as a single parameter whose value is `;boundary=AaB03x`, which is not a legal boundary under RFC 2046, so the only conformant outcome is rejection. Inspecting intermediaries that implement the standard grammar, such as ModSecurity, see a different boundary or no multipart body at all.

The fix counts `boundary=` occurrences across the entire header value and rejects the request when there is more than one.

## Impact

As with CVE-2026-26961, an attacker can craft a multipart request that a web application firewall or other inspecting proxy in front of a Rack application interprets differently from Rack, so form fields and file uploads reach the application without inspection. Rack itself grants no capability beyond that of a well-formed request with the same body. All supported versions, including 2.2, are affected.

## Mitigation

* Update to a patched version of Rack.
* Reject requests whose `Content-Type` contains more than one `boundary` parameter at the reverse proxy.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_