CVE-2026-125108 Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-125108?
CVE-2026-125108 is a low-severity vulnerability in rack, published on 9 Nov 2026.
Official description
Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parse_boundary can skip a leading empty or quoted boundary parameter in a multipart Content-Type header and accept a later parameter. Rack can therefore parse a request body with a boundary that a conforming intermediary would not derive, allowing form fields or file uploads to reach an application without the intended proxy or web application firewall inspection. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8.
Weakness: CWE-436
Which versions are affected by CVE-2026-125108?
3 open source packages ship an affected version, including rack.
| Package | Affected | Fixed in |
|---|---|---|
rack RubyGems | All versions | 2.2.25 |
rack RubyGems | From 3.0.0 | 3.1.23 |
rack RubyGems | From 3.2.0 | 3.2.8 |
How do I fix CVE-2026-125108?
Upgrade rack to a fixed version for your release line: 2.2.25, 3.1.23 or 3.2.8.
Is CVE-2026-125108 being exploited?
There is no known exploitation of CVE-2026-125108 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-125108, GHSA-p8x9-v4hv-2w4g, UBUNTU-CVE-2026-125108.