CVE-2026-125111

Rack: Multipart parsing allows DoS via unbounded scan buffer growth

rack, rack, rack

## Summary `Rack::Multipart::Parser` reads the request body in chunks of `rack.multipart.buffer_size` (1 MiB by default) into an internal scan buffer. Parsed bytes are only discarded from that buffer when a chunk ends inside a part body. A request whose parts are sized so that every chunk ends inside, or immediately after, a part's headers is never compacted, so the buffer grows to the size of the request. This results in a denial of service condition through memory…

10. Nov 2026

Ausgewertete Quellen

• GitHub
  GHSA-5v64-555j-wjxm