CVE-2026-34829 rack CVE debrief

Who should care

Developers and administrators using Rack applications that accept multipart form data should be aware of this vulnerability. This includes users of Ruby on Rails, as Rack is a dependency. The vulnerability can be exploited by an unauthenticated attacker, making it a significant concern for applications exposed to the internet.

Technical summary

The vulnerability in Rack::Multipart::Parser allows for unbounded disk space consumption during multipart file uploads when the Content-Length header is missing. This is because the parser only wraps the request body in a BoundedIO when CONTENT_LENGTH is present. For file parts, the uploaded body is written directly to a temporary file on disk without being constrained by an in-memory upload limit. An attacker can exploit this by streaming an arbitrarily large multipart file upload.

Defensive priority

High priority should be given to upgrading Rack to versions 2.2.23, 3.1.21, or 3.2.6. In the meantime, consider implementing compensating controls such as monitoring for large file uploads and setting limits on upload sizes.

Recommended defensive actions

• Upgrade Rack to version 2.2.23, 3.1.21, or 3.2.6.
• Implement monitoring for large file uploads.
• Set limits on upload sizes as a compensating control.
• Review application code for insecure direct object references.
• Perform regular security audits and vulnerability assessments.

Evidence notes

The CVE record and NVD detail provide comprehensive information about the vulnerability. The vendor advisory on GitHub and Red Hat's security advisories offer additional context and mitigation strategies.

Official resources