{"id":"CVE-2026-125111","kind":"vulnerability","aliases":["CVE-2026-125111","GHSA-5v64-555j-wjxm"],"related":[],"title":"Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.","description":"## Summary\n\n`Rack::Multipart::Parser` reads the request body in chunks of `rack.multipart.buffer_size` (1 MiB by default) into an internal scan buffer. Parsed bytes are only discarded from that buffer when a chunk ends inside a part body. A request whose parts are sized so that every chunk ends inside, or immediately after, a part's headers is never compacted, so the buffer grows to the size of the request.\n\nThis results in a denial of service condition through memory exhaustion for applications that parse multipart requests.\n\n## Details\n\nThe parser appends each chunk read from the input to a `StringScanner` and advances through boundaries, headers, and bodies. In the body state, when no closing boundary is found, the consumed prefix is removed before more data is read. In the header state, and in the body state when no body bytes have been consumed yet, the parser requests more data without removing anything. Bytes skipped between parts are not counted against any limit.\n\nAn attacker can therefore construct parts that each fit within one chunk and align the chunk boundaries with the part headers. The existing limits on buffered non-file field data, header size, and preamble size do not apply, because each individual part remains small. With default limits the buffer can reach roughly 4 GiB (4096 parts of about 1 MiB). Ordinary file uploads aligned the same way are bounded by the file part limit at roughly 128 MiB per request.\n\n## Impact\n\nAny application that parses multipart requests with Rack is affected in its default configuration. An unauthenticated attacker can cause a single request to hold memory proportional to its size for the duration of parsing, exhausting worker memory. The attack requires only a well-formed multipart body.\n\n## Mitigation\n\n* Update to a patched version of Rack in which the parser discards parsed bytes from its scan buffer before reading more data.\n* Limit the request body size at a reverse proxy or application boundary.\n* Set `RACK_MULTIPART_PARSER_BYTESIZE_LIMIT` to the largest multipart body the application needs to accept, which bounds the memory a single request can hold.","summary":"Rack's multipart parser keeps already-parsed request bytes in its scan buffer when parts are aligned with read chunks, so the buffer grows to the full request size. An unauthenticated attacker sending a crafted but well-formed multipart body can exhaust worker memory and deny service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"rack","fixed":["2.2.25"],"affected":"< 2.2.25","ecosystem":"rubygems"},{"name":"rack","fixed":["3.1.23"],"affected":">= 3.0, < 3.1.23","ecosystem":"rubygems"},{"name":"rack","fixed":["3.2.8"],"affected":">= 3.2, < 3.2.8","ecosystem":"rubygems"}],"ecosystems":["rubygems"],"tags":["cwe-400","package","rack","rails","ruby","self-hosted"],"not_affected_if":["body-size-limit","no-multipart-endpoints","patched-version"],"how_to_check":"- Check the locked Rack version in `Gemfile.lock` (`grep rack Gemfile.lock`) and compare it with the fixed versions below.\n- Run `bundle exec gem list rack` to see the version that actually loads.\n- Confirm the app parses multipart requests (file uploads or multipart form posts) through Rack.","fix":"- `rack` 2.x: upgrade to `2.2.25` or later.\n- `rack` 3.1.x: upgrade to `3.1.23` or later.\n- `rack` 3.2.x: upgrade to `3.2.8` or later.\n- Until patched, set `RACK_MULTIPART_PARSER_BYTESIZE_LIMIT` to the largest multipart body the app needs, or limit request body size at a reverse proxy.","status":"open","published_at":"2026-10-30T02:18:55+00:00","first_seen_at":"2026-11-09T22:53:30+00:00","triaged_at":"2026-11-09T22:54:24+00:00","updated_at":"2026-11-09T22:54:24+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-11-09T22:54:24Z","model":"claude-haiku-5-5","output":{"fix":"- `rack` 2.x: upgrade to `2.2.25` or later.\n- `rack` 3.1.x: upgrade to `3.1.23` or later.\n- `rack` 3.2.x: upgrade to `3.2.8` or later.\n- Until patched, set `RACK_MULTIPART_PARSER_BYTESIZE_LIMIT` to the largest multipart body the app needs, or limit request body size at a reverse proxy.","reach":"internet","title":"Rack: multipart parser memory grows with request size, enabling denial of service","impact":"medium","summary":"Rack's multipart parser keeps already-parsed request bytes in its scan buffer when parts are aligned with read chunks, so the buffer grows to the full request size. An unauthenticated attacker sending a crafted but well-formed multipart body can exhaust worker memory and deny service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["rack","ruby","rails","self-hosted"],"confidence":0.9,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated requests exhaust worker memory and deny service","analyst_note":"","how_to_check":"- Check the locked Rack version in `Gemfile.lock` (`grep rack Gemfile.lock`) and compare it with the fixed versions below.\n- Run `bundle exec gem list rack` to see the version that actually loads.\n- Confirm the app parses multipart requests (file uploads or multipart form posts) through Rack.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version","no-multipart-endpoints","body-size-limit"],"who_is_affected":"Any Ruby application that parses multipart requests through Rack in its default configuration is exposed, since the parser runs on every multipart body the server receives. Applications that only serve JSON or sit behind a proxy that caps request body size are much less exposed. Apps on a patched Rack version, or using a body size limit, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000896,"input_tokens":5271,"output_tokens":737,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125111':19A,27A '-2026':18A,26A '-400':32B '1':102C,310C '128':328C '4':304C '4096':306C '555j':23A '5v64':22A 'accept':430C 'advanc':190C 'affect':342C 'align':57B,264C,315C 'allow':10A 'alreadi':46B 'already-pars':45B 'anyth':240C 'append':179C 'appli':289C 'applic':171C,334C,413C,427C 'attack':72B,252C,349C,371C 'bodi':81B,96C,126C,195C,198C,223C,227C,379C,406C,425C 'bound':320C,432C 'boundari':192C,203C,267C,414C 'buffer':9A,53B,63B,110C,118C,151C,276C,300C,398C 'byte':49B,112C,228C,241C,394C 'bytes':419C 'caus':351C 'chunk':60B,98C,121C,136C,181C,262C,266C 'close':202C 'compact':148C 'condit':166C 'configur':346C 'construct':255C 'consum':207C,231C 'count':247C 'craft':75B 'cve':17A,25A 'cwe':31B 'data':5A,213C,237C,281C,402C 'default':105C,297C,345C 'deni':87B 'denial':11A,163C 'detail':176C 'discard':115C,392C 'durat':364C 'end':122C,137C 'everi':135C 'exhaust':16A,83B,169C,367C 'exist':273C 'field':280C 'file':279C,313C,323C 'fit':259C 'form':79B,377C 'found':205C 'full':67B 'ghsa':21A 'ghsa-5v64-555j-wjxm':20A 'gib':305C 'grow':64B,152C 'header':145C,193C,218C,271C,282C 'hold':356C,439C 'host':39B 'immedi':140C 'impact':332C 'individu':292C 'input':185C 'insid':123C,138C 'intern':108C 'keep':44B 'largest':423C 'limit':250C,274C,298C,325C,403C,420C 'memori':15A,85B,168C,357C,369C,434C 'mib':103C,311C,329C 'mitig':380C 'multipart':1A,42B,80B,91C,174C,337C,378C,417C,424C 'need':428C 'never':147C 'non':278C 'non-fil':277C 'one':261C 'ordinari':312C 'packag':33B 'pars':4A,47B,111C,173C,336C,366C,393C 'parser':2A,43B,92C,178C,234C,391C,418C 'part':55B,125C,130C,143C,244C,256C,270C,293C,307C,324C 'patch':384C 'per':330C 'preambl':285C 'prefix':208C 'proport':358C 'proxi':411C 'rack':28A,29A,30A,34B,40B,90C,340C,387C,416C 'rack.multipart.buffer':100C 'rail':35B 'reach':302C 'read':59B,93C,182C,215C,400C 'remain':294C 'remov':210C,239C 'request':48B,68B,95C,128C,158C,175C,235C,331C,338C,354C,405C,437C 'requir':372C 'result':160C 'retain':3A 'revers':410C 'rough':303C,327C 'rubi':36B 'scan':8A,52B,109C,397C 'self':38B 'self-host':37B 'send':73B 'servic':13A,88B,165C 'set':415C 'singl':353C,436C 'size':69B,101C,132C,155C,283C,286C,361C,407C 'skip':242C 'small':295C 'state':199C,219C,224C 'stringscann':188C 'summari':89C 'therefor':254C 'unauthent':71B,348C 'updat':381C 'upload':314C 'version':385C 'via':14A 'way':318C 'well':78B,376C 'well-form':77B,375C 'whose':129C 'within':260C 'without':238C 'wjxm':24A 'worker':84B,368C 'yet':232C","nicknames":[],"mitigations":[],"who_affected":"Any Ruby application that parses multipart requests through Rack in its default configuration is exposed, since the parser runs on every multipart body the server receives. Applications that only serve JSON or sit behind a proxy that caps request body size are much less exposed. Apps on a patched Rack version, or using a body size limit, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["rack"],"ptokens":["rack"],"labels":["cwe400","high","package","rack","rails","ruby","rubygems","selfhosted"],"campaign_type":null,"search_a":"'-125111':19A,27A '-2026':18A,26A '555j':23A '5v64':22A 'allow':10A 'buffer':9A 'cve':17A,25A 'data':5A 'denial':11A 'exhaust':16A 'ghsa':21A 'ghsa-5v64-555j-wjxm':20A 'memori':15A 'multipart':1A 'pars':4A 'parser':2A 'rack':28A,29A,30A 'retain':3A 'scan':8A 'servic':13A 'via':14A 'wjxm':24A","search_b":"'-400':32B 'align':57B 'alreadi':46B 'already-pars':45B 'attack':72B 'bodi':81B 'buffer':53B,63B 'byte':49B 'chunk':60B 'craft':75B 'cwe':31B 'deni':87B 'exhaust':83B 'form':79B 'full':67B 'grow':64B 'host':39B 'keep':44B 'memori':85B 'multipart':42B,80B 'packag':33B 'pars':47B 'parser':43B 'part':55B 'rack':34B,40B 'rail':35B 'read':59B 'request':48B,68B 'rubi':36B 'scan':52B 'self':38B 'self-host':37B 'send':73B 'servic':88B 'size':69B 'unauthent':71B 'well':78B 'well-form':77B 'worker':84B","search_c":"'1':102C,310C '128':328C '4':304C '4096':306C 'accept':430C 'advanc':190C 'affect':342C 'align':264C,315C 'anyth':240C 'append':179C 'appli':289C 'applic':171C,334C,413C,427C 'attack':252C,349C,371C 'bodi':96C,126C,195C,198C,223C,227C,379C,406C,425C 'bound':320C,432C 'boundari':192C,203C,267C,414C 'buffer':110C,118C,151C,276C,300C,398C 'byte':112C,228C,241C,394C 'bytes':419C 'caus':351C 'chunk':98C,121C,136C,181C,262C,266C 'close':202C 'compact':148C 'condit':166C 'configur':346C 'construct':255C 'consum':207C,231C 'count':247C 'data':213C,237C,281C,402C 'default':105C,297C,345C 'denial':163C 'detail':176C 'discard':115C,392C 'durat':364C 'end':122C,137C 'everi':135C 'exhaust':169C,367C 'exist':273C 'field':280C 'file':279C,313C,323C 'fit':259C 'form':377C 'found':205C 'gib':305C 'grow':152C 'header':145C,193C,218C,271C,282C 'hold':356C,439C 'immedi':140C 'impact':332C 'individu':292C 'input':185C 'insid':123C,138C 'intern':108C 'largest':423C 'limit':250C,274C,298C,325C,403C,420C 'memori':168C,357C,369C,434C 'mib':103C,311C,329C 'mitig':380C 'multipart':91C,174C,337C,378C,417C,424C 'need':428C 'never':147C 'non':278C 'non-fil':277C 'one':261C 'ordinari':312C 'pars':111C,173C,336C,366C,393C 'parser':92C,178C,234C,391C,418C 'part':125C,130C,143C,244C,256C,270C,293C,307C,324C 'patch':384C 'per':330C 'preambl':285C 'prefix':208C 'proport':358C 'proxi':411C 'rack':90C,340C,387C,416C 'rack.multipart.buffer':100C 'reach':302C 'read':93C,182C,215C,400C 'remain':294C 'remov':210C,239C 'request':95C,128C,158C,175C,235C,331C,338C,354C,405C,437C 'requir':372C 'result':160C 'revers':410C 'rough':303C,327C 'scan':109C,397C 'servic':165C 'set':415C 'singl':353C,436C 'size':101C,132C,155C,283C,286C,361C,407C 'skip':242C 'small':295C 'state':199C,219C,224C 'stringscann':188C 'summari':89C 'therefor':254C 'unauthent':348C 'updat':381C 'upload':314C 'version':385C 'way':318C 'well':376C 'well-form':375C 'whose':129C 'within':260C 'without':238C 'worker':368C 'yet':232C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-30T02:18:55+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-5v64-555j-wjxm","url":"https://github.com/rack/rack/security/advisories/GHSA-5v64-555j-wjxm","severity":"high","published_at":"2026-10-30T02:18:55+00:00","modified_at":"2026-11-09T22:01:42+00:00","first_seen_at":"2026-11-09T22:53:30+00:00","fetched_at":"2026-11-09T22:53:30+00:00","note":null}],"documents":[{"id":110684,"url":"https://github.com/rack/rack/security/advisories/GHSA-5v64-555j-wjxm","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}