CVE-2026-34827 Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser
An unauthenticated attacker can cause denial of service in Rack applications by sending crafted multipart requests with excessive escape characters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34827?
CVE-2026-34827 is a high-severity denial of service vulnerability in rack, published on 2 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Multipart::Parser#handle_mime_head parses quoted multipart parameters such as Content-Disposition: form-data; name="..." using repeated String#index searches combined with String#slice! prefix deletion. For escape-heavy quoted values, this causes super-linear processing. An unauthenticated attacker can send a crafted multipart/form-data request containing many parts with long backslash-escaped parameter values to trigger excessive CPU usage during multipart parsing. This results in a denial of service condition in Rack applications that accept multipart form data. This issue has been patched in versions 3.1.21 and 3.2.6.
Which versions are affected by CVE-2026-34827?
4 open source packages ship an affected version, including rack. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rack RubyGems | From 3.0.0.beta1 | 3.1.21 |
rack RubyGems | From 3.0.0.beta1 | 3.1.21 |
rack RubyGems | From 3.2.0 | 3.2.6 |
rack RubyGems | From 3.2.0 | 3.2.6 |
Products include Rack Rack.
How do I fix CVE-2026-34827?
Upgrade rack to a fixed version for your release line: 3.1.21 or 3.2.6.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-34827 being exploited?
There is no known exploitation of CVE-2026-34827 in the wild and no public exploit code.
Other vulnerabilities in rack
- CVE-2026-34785 Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching
- CVE-2026-34829 Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length
- CVE-2026-22860 Rack has a Directory Traversal via Rack:Directory
- CVE-2025-61919 Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing
- CVE-2025-61770 Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)
Sources
Also known as DEBIAN-CVE-2026-34827, GHSA-v6x5-cg8r-vv6x, MINI-2p3f-vf25-hhhr, MINI-3j44-59wr-25h4, MINI-44r8-m2m6-hc35, MINI-4fhq-53gq-9q32 and 8 more.