4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-26962

CVE-2026-26962: Rack: Header injection in multipart requests

Rack is a modular Ruby web server interface. From version 3.2.0 to before version 3.2.6, Rack::Multipart::Parser unfolds folded multipart part headers incorrectly. When a multipart header contains an obs-fold sequence, Rack preserves the embedded CRLF in parsed parameter values such as filename or name instead of removing the folded line break during unfolding. As a result, applications that later reuse those parsed values in HTTP response headers may be vulnerable to downstream header injection or response splitting. This issue has been patched in version 3.2.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-26962

CVE-2026-26962:

4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
rack	rubygems	>= 3.2.0, < 3.2.6	3.2.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2026-26962, stems from the improper handling of folded multipart headers in Rack, which could lead to CRLF injection. The advisory points to Rack::Multipart::Parser as the component responsible. By analyzing the commits between the last vulnerable version (3.2.5) and the first patched version (3.2.6), I identified commit d50c4d3dab62fa80b2a276271d0d4fb338cfa7df as the security patch. This commit's message, "Implement OBS unfolding for multipart requests per RFC 5322 2.2.3", directly corresponds to the vulnerability description. The code changes are confined to the lib/rack/multipart/parser.rb file, specifically within the handle_mime_head method. The patch introduces logic to substitute the obs-fold sequence (\r\n followed by whitespace) with just the whitespace, thereby removing the dangerous CRLF sequence from the parsed Content-Disposition and Content-Type header values. The associated test case confirms this behavior by checking that a filename containing a folded line break is parsed correctly without the CRLF. Therefore, the handle_mime_head method is the precise location of the vulnerable code.

Vulnerable functions

Rack::Multipart::Parser.handle_mime_head

lib/rack/multipart/parser.rb

The `handle_mime_head` function in `Rack::Multipart::Parser` is responsible for parsing headers of a multipart part. Before the patch, this function did not correctly handle 'obs-fold' sequences (a CRLF followed by a space or tab) in header values. This resulted in the CRLF characters being preserved in parsed parameter values, such as the 'filename' in a 'Content-Disposition' header. If an application used this unsanitized value to construct an HTTP response header, it could be vulnerable to CRLF injection (also known as HTTP response splitting). The patch fixes this by using a regular expression to find and replace these folded line breaks, effectively removing the CRLF.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.