Niedrig 3.7Linux-Server
CVE-2026-125108
rack: rack: Security inspection bypass via multipart boundary parsing differential
rack
## Summary The guard added for CVE-2026-26961 (GHSA-vgpv-f759-9wx3), which rejects multipart requests with more than one `boundary` parameter, only inspects the part of the `Content-Type` header after the boundary it extracts. A `Content-Type` whose first `boundary` parameter is empty or begins with a quote, semicolon, or comma is skipped by the extraction pattern, so a second `boundary` parameter is accepted silently and Rack parses the body with a boundary that a…
9. Nov 2026
Original bei Red Hat öffnen