CVE-2026-34829 Details

A denial-of-service vulnerability has been identified in Rack, a Ruby web server interface, in versions prior to 2.2.23, 3.1.21, and 3.2.6. The issue arises in the `Rack::Multipart::Parser`, which only wraps the request body in a `BoundedIO` when the `CONTENT_LENGTH` header is present. Without this header, such as in HTTP chunked transfer encoding, the parser reads the multipart body until the end of the stream, without any size limit. This allows an unauthenticated attacker to upload large files through multipart form data, directly to temporary files on disk, bypassing the in-memory upload limit. The result is unbounded disk usage, potentially leading to application failures or service disruptions.

Users can update to Rack versions 2.2.23, 3.1.21, or 3.2.6, which include the patch for this vulnerability. Additionally, request body size limits can be enforced at the reverse proxy or application server level, and temporary upload storage should be isolated and monitored for disk usage on multipart endpoints.