CVE-2026-125108

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-125108", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-11-09T17:45:35.935Z", "datePublished": "2026-11-09T21:55:20.600Z", "dateUpdated": "2026-11-09T21:55:20.600Z"}, "containers": {"cna": {"title": "Rack: Multipart boundary ambiguity guard in Rack::Multipart::Parser can be bypassed with a quoted boundary value, allowing WAF bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-436", "lang": "en", "description": "CWE-436: Interpretation Conflict", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/rack/rack/security/advisories/GHSA-p8x9-v4hv-2w4g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rack/rack/security/advisories/GHSA-p8x9-v4hv-2w4g"}, {"name": "https://github.com/rack/rack/commit/19a1a19cb4da97d61c8d5effeb2e927c44370ae9", "tags": ["x_refsource_MISC"], "url": "https://github.com/rack/rack/commit/19a1a19cb4da97d61c8d5effeb2e927c44370ae9"}, {"name": "https://github.com/rack/rack/commit/a29512324265790a5536b830490075d0d79323be", "tags": ["x_refsource_MISC"], "url": "https://github.com/rack/rack/commit/a29512324265790a5536b830490075d0d79323be"}, {"name": "https://github.com/rack/rack/commit/d5e928b803da30b8e40171dbd4be39bed7daa6fa", "tags": ["x_refsource_MISC"], "url": "https://github.com/rack/rack/commit/d5e928b803da30b8e40171dbd4be39bed7daa6fa"}, {"name": "https://github.com/rack/rack/releases/tag/v2.2.25", "tags": ["x_refsource_MISC"], "url": "https://github.com/rack/rack/releases/tag/v2.2.25"}, {"name": "https://github.com/rack/rack/releases/tag/v3.1.23", "tags": ["x_refsource_MISC"], "url": "https://github.com/rack/rack/releases/tag/v3.1.23"}, {"name": "https://github.com/rack/rack/releases/tag/v3.2.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/rack/rack/releases/tag/v3.2.8"}], "affected": [{"vendor": "rack", "product": "rack", "versions": [{"version": "< 2.2.25", "status": "affected"}, {"version": ">= 3.0, < 3.1.23", "status": "affected"}, {"version": ">= 3.2, < 3.2.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-09T21:55:20.600Z"}, "descriptions": [{"lang": "en", "value": "Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parse_boundary can skip a leading empty or quoted boundary parameter in a multipart Content-Type header and accept a later parameter. Rack can therefore parse a request body with a boundary that a conforming intermediary would not derive, allowing form fields or file uploads to reach an application without the intended proxy or web application firewall inspection. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8."}], "source": {"advisory": "GHSA-p8x9-v4hv-2w4g", "discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"product": "rack", "vendor": "rack", "versions": [{"status": "affected", "version": "< 2.2.25"}, {"status": "affected", "version": ">= 3.0, < 3.1.23"}, {"status": "affected", "version": ">= 3.2, < 3.2.8"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser.parse_boundary can skip a leading empty or quoted boundary parameter in a multipart Content-Type header and accept a later parameter. Rack can therefore parse a request body with a boundary that a conforming intermediary would not derive, allowing form fields or file uploads to reach an application without the intended proxy or web application firewall inspection. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8."}], "id": "CVE-2026-125108", "lastModified": "2026-11-12T19:18:09.510", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-11-09T22:18:41.963", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/rack/rack/commit/19a1a19cb4da97d61c8d5effeb2e927c44370ae9"}, {"source": "security-advisories@github.com", "url": "https://github.com/rack/rack/commit/a29512324265790a5536b830490075d0d79323be"}, {"source": "security-advisories@github.com", "url": "https://github.com/rack/rack/commit/d5e928b803da30b8e40171dbd4be39bed7daa6fa"}, {"source": "security-advisories@github.com", "url": "https://github.com/rack/rack/releases/tag/v2.2.25"}, {"source": "security-advisories@github.com", "url": "https://github.com/rack/rack/releases/tag/v3.1.23"}, {"source": "security-advisories@github.com", "url": "https://github.com/rack/rack/releases/tag/v3.2.8"}, {"source": "security-advisories@github.com", "url": "https://github.com/rack/rack/security/advisories/GHSA-p8x9-v4hv-2w4g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-436"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{"bugzilla": {"description": "rack: rack: Security inspection bypass via multipart boundary parsing differential", "id": "2570275", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570275"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-444", "details": ["A flaw was found in Rack. When parsing multipart requests, Rack can skip an invalid or empty leading boundary parameter in the Content-Type header and process a subsequent boundary instead. A remote attacker can exploit this issue by sending specially crafted multipart requests that intermediate security proxies or Web Application Firewalls (WAFs) interpret differently than Rack. This parsing inconsistency can allow malicious form fields or file uploads to bypass upstream security inspections and reach the backend application directly."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-125108", "package_state": [{"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/backend-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Out of support scope", "package_name": "3scale-amp2/system-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/system-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/zync-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "pcs", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Fix deferred", "package_name": "pcs", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "pcs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "pcs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "package_name": "rhosp13/openstack-cinder-backup", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "package_name": "rhosp13/openstack-cinder-volume", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "package_name": "rhosp13/openstack-haproxy", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "package_name": "rhosp13/openstack-manila-share", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "package_name": "rhosp13/openstack-mariadb", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "package_name": "rhosp13/openstack-ovn-northd", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "package_name": "rhosp13/openstack-rabbitmq", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "package_name": "rhosp13/openstack-redis", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "rhosp-rhel8/openstack-cinder-backup", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "rhosp-rhel8/openstack-cinder-volume", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "rhosp-rhel8/openstack-haproxy", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "rhosp-rhel8/openstack-manila-share", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "rhosp-rhel8/openstack-mariadb", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "rhosp-rhel8/openstack-ovn-northd", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "rhosp-rhel8/openstack-rabbitmq", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "rhosp-rhel8/openstack-redis", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Out of support scope", "package_name": "rhosp-rhel9/openstack-cinder-backup", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Out of support scope", "package_name": "rhosp-rhel9/openstack-cinder-volume", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Out of support scope", "package_name": "rhosp-rhel9/openstack-haproxy", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Out of support scope", "package_name": "rhosp-rhel9/openstack-manila-share", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Out of support scope", "package_name": "rhosp-rhel9/openstack-mariadb", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Out of support scope", "package_name": "rhosp-rhel9/openstack-ovn-northd", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Out of support scope", "package_name": "rhosp-rhel9/openstack-rabbitmq", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Out of support scope", "package_name": "rhosp-rhel9/openstack-redis", "product_name": "Red Hat OpenStack Platform 17.1"}], "public_date": "2026-11-09T21:55:20Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-125108\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-125108\nhttps://github.com/rack/rack/commit/19a1a19cb4da97d61c8d5effeb2e927c44370ae9\nhttps://github.com/rack/rack/commit/a29512324265790a5536b830490075d0d79323be\nhttps://github.com/rack/rack/commit/d5e928b803da30b8e40171dbd4be39bed7daa6fa\nhttps://github.com/rack/rack/releases/tag/v2.2.25\nhttps://github.com/rack/rack/releases/tag/v3.1.23\nhttps://github.com/rack/rack/releases/tag/v3.2.8\nhttps://github.com/rack/rack/security/advisories/GHSA-p8x9-v4hv-2w4g"], "statement": "This vulnerability is rated as having a Low impact because exploiting it requires an intermediary inspection proxy in the request path and cannot directly compromise the backend host or grant code execution on its own. The inconsistency in multipart header interpretation allows crafted payloads to bypass front-end security filters, yet the underlying application still processes all incoming parameters and uploaded files according to its internal application logic. Consequently, successful exploitation does not grant additional capabilities beyond what standard HTTP requests provide and poses minimal threat in deployments without vulnerable backend handlers.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.2.25)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.0,3.1.23)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.2,3.2.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "rack", "source": "cna", "vendor": "rack"}, "product": "rack", "vendor": "rack"}], "created": "2026-11-09T23:30:17.907920+00:00", "updated": "2026-11-09T23:30:18.549633+00:00", "vendors": ["rack", "rack$PRODUCT$rack"]}