---
id: "CVE-2026-125111"
page: "https://infrastack.ai/live/CVE-2026-125111"
kind: "vulnerability"
aliases: ["CVE-2026-125111", "GHSA-5v64-555j-wjxm"]
title: "Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion."
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "rack", "fixed": ["2.2.25"], "affected": "< 2.2.25", "ecosystem": "rubygems"}, {"name": "rack", "fixed": ["3.1.23"], "affected": ">= 3.0, < 3.1.23", "ecosystem": "rubygems"}, {"name": "rack", "fixed": ["3.2.8"], "affected": ">= 3.2, < 3.2.8", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["cwe-400", "package", "rack", "rails", "ruby", "self-hosted"]
not_affected_if: ["body-size-limit", "no-multipart-endpoints", "patched-version"]
published_at: "2026-10-30T02:18:55+00:00"
first_seen_at: "2026-11-09T22:53:30+00:00"
updated_at: "2026-11-09T22:54:24+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/rack/rack/security/advisories/GHSA-5v64-555j-wjxm", "first_seen_at": "2026-11-09T22:53:30+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125111", "first_seen_at": "2026-11-10T00:28:47+00:00"}]
exploit_sources: []
---

# Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.

Link for people: https://infrastack.ai/live/CVE-2026-125111 (this .md is for agents)

Rack's multipart parser keeps already-parsed request bytes in its scan buffer when parts are aligned with read chunks, so the buffer grows to the full request size. An unauthenticated attacker sending a crafted but well-formed multipart body can exhaust worker memory and deny service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:rack affected < 2.2.25 fixed 2.2.25
- rubygems:rack affected >= 3.0, < 3.1.23 fixed 3.1.23
- rubygems:rack affected >= 3.2, < 3.2.8 fixed 3.2.8

## How to check

- Check the locked Rack version in `Gemfile.lock` (`grep rack Gemfile.lock`) and compare it with the fixed versions below.
- Run `bundle exec gem list rack` to see the version that actually loads.
- Confirm the app parses multipart requests (file uploads or multipart form posts) through Rack.

## Fix

- `rack` 2.x: upgrade to `2.2.25` or later.
- `rack` 3.1.x: upgrade to `3.1.23` or later.
- `rack` 3.2.x: upgrade to `3.2.8` or later.
- Until patched, set `RACK_MULTIPART_PARSER_BYTESIZE_LIMIT` to the largest multipart body the app needs, or limit request body size at a reverse proxy.

## Timeline

- 2026-11-09T22:53:30+00:00 ghsa-repo https://github.com/rack/rack/security/advisories/GHSA-5v64-555j-wjxm
- 2026-11-10T00:28:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125111

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/rack/rack/security/advisories/GHSA-5v64-555j-wjxm
- [fix] Patch: github.com https://github.com/rack/rack/commit/244e75a840cee0823f86d5d01dc374505a8abed8
- [fix] Patch: github.com https://github.com/rack/rack/commit/2eaa5b1026a03a43b6537b1a0b233707ba887702
- [fix] Patch: github.com https://github.com/rack/rack/commit/c9b4698595050838342bd3b5a0fc9ab908065f8f

## From the sources

## Summary

`Rack::Multipart::Parser` reads the request body in chunks of `rack.multipart.buffer_size` (1 MiB by default) into an internal scan buffer. Parsed bytes are only discarded from that buffer when a chunk ends inside a part body. A request whose parts are sized so that every chunk ends inside, or immediately after, a part's headers is never compacted, so the buffer grows to the size of the request.

This results in a denial of service condition through memory exhaustion for applications that parse multipart requests.

## Details

The parser appends each chunk read from the input to a `StringScanner` and advances through boundaries, headers, and bodies. In the body state, when no closing boundary is found, the consumed prefix is removed before more data is read. In the header state, and in the body state when no body bytes have been consumed yet, the parser requests more data without removing anything. Bytes skipped between parts are not counted against any limit.

An attacker can therefore construct parts that each fit within one chunk and align the chunk boundaries with the part headers. The existing limits on buffered non-file field data, header size, and preamble size do not apply, because each individual part remains small. With default limits the buffer can reach roughly 4 GiB (4096 parts of about 1 MiB). Ordinary file uploads aligned the same way are bounded by the file part limit at roughly 128 MiB per request.

## Impact

Any application that parses multipart requests with Rack is affected in its default configuration. An unauthenticated attacker can cause a single request to hold memory proportional to its size for the duration of parsing, exhausting worker memory. The attack requires only a well-formed multipart body.

## Mitigation

* Update to a patched version of Rack in which the parser discards parsed bytes from its scan buffer before reading more data.
* Limit the request body size at a reverse proxy or application boundary.
* Set `RACK_MULTIPART_PARSER_BYTESIZE_LIMIT` to the largest multipart body the application needs to accept, which bounds the memory a single request can hold.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_