PT-2026-29841 · Rack+2 · Rack+2

Wtn · Published 2026-04-02 · Updated 2026-04-17 · CVE-2026-26962

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Rack versions 3.2.0 through 3.2.5

Description Rack’s Rack::Multipart::Parser incorrectly unfolds folded multipart part headers. When a multipart header contains an obs-fold sequence, Rack preserves the embedded CRLF in parsed parameter values such as filename or name instead of removing the folded line break during unfolding. This can lead to applications reusing these values in HTTP response headers being vulnerable to downstream header injection or response splitting.

Recommendations Update to Rack version 3.2.6 or later.

Exploit

Fix

Weakness Enumeration

CWE-93

Related Identifiers

CVE-2026-26962

GHSA-RX22-G9MX-QRHV

USN-8182-1

Affected Products

Linuxmint

Rack

Ubuntu

References · 24

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-26962.yml · Exploit
• https://github.com/rack/rack/security/advisories/GHSA-rx22-g9mx-qrhv · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34826 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8182-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34786 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-26962 · Security Note
• https://osv.dev/vulnerability/GHSA-rx22-g9mx-qrhv · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-26962 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34785 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-26961 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34763 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34827 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34835 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34831 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26962 · Security Note