CVE-2026-26961 (Low) detected in rack-3.2.5.gem

Nobody has claimed this yet.

## CVE-2026-26961 - Low Severity Vulnerability
Vulnerable Library - rack-3.2.5.gem

Rack provides a minimal, modular and adaptable interface for developing
web applications in Ruby. By wrapping HTTP requests and responses in
the simplest way possible, it unifies and distills the API for web
servers, web frameworks, and software in between (the so-called
middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-3.2.5.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.2.5.gem

Dependency Hierarchy:
- manageiq-style-1.6.0.gem (Root Library)
- :x: **rack-3.2.5.gem** (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser extracts the boundary parameter from multipart/form-data using a greedy regular expression. When a Content-Type header contains multiple boundary parameters, Rack selects the last one rather than the first. In deployments where an upstream proxy, WAF, or intermediary interprets the first boundary parameter, this mismatch can allow an attacker to smuggle multipart content past upstream inspection and have Rack parse a different body structure than the intermediary validated. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

Publish Date: 2026-04-02

URL: CVE-2026-26961

CVSS 3 Score Details (3.7)

Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-vgpv-f759-9wx3

Release Date: 2026-04-02

Fix Resolution: rack - 3.2.6,rack - 3.1.21,rack - 2.2.23

***
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)

Start with /Gemfile.lock and the cached /vendor/cache/rack-3.2.5.gem to see how Rack is pinned and vendored. Update the dependency to a fixed Rack release listed in the issue, regenerate the dependency metadata as needed, and verify that neither path retains the vulnerable 3.2.5 version.

Written by the indexing model from the issue text.