CVE-2026-125111 Rack: Multipart parsing allows DoS via unbounded scan buffer growth
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-125111?
CVE-2026-125111 is a high-severity vulnerability in rack, published on 9 Nov 2026.
Official description
Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can align many small parts with rack.multipart.buffer_size boundaries so the buffer grows with the request despite per-field, header, and preamble limits, causing a worker to exhaust memory. The attack requires only a well-formed multipart body and affects applications that parse multipart requests. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8.
Weakness: CWE-400
Which versions are affected by CVE-2026-125111?
3 open source packages ship an affected version, including rack.
| Package | Affected | Fixed in |
|---|---|---|
rack RubyGems | All versions | 2.2.25 |
rack RubyGems | From 3.0.0 | 3.1.23 |
rack RubyGems | From 3.2.0 | 3.2.8 |
How do I fix CVE-2026-125111?
Upgrade rack to a fixed version for your release line: 2.2.25, 3.1.23 or 3.2.8.
Is CVE-2026-125111 being exploited?
There is no known exploitation of CVE-2026-125111 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-125111, GHSA-5v64-555j-wjxm, UBUNTU-CVE-2026-125111.