CVE-2026-26962

Rack is a modular Ruby web server interface. From version 3.2.0 to before version 3.2.6, Rack::Multipart::Parser unfolds folded multipart part headers incorrectly. When a multipart header contains an obs-fold sequence, Rack preserves the embedded CRLF in parsed parameter values such as filename or name instead of removing the folded line break during unfolding. As a result, applications that later reuse those parsed values in HTTP response headers may be vulnerable to downstream header injection or response splitting. This issue has been patched in version 3.2.6.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-93"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26962.json"
}

References

Affected packages

Git / github.com/rack/rack

Affected ranges

Type

GIT

Repo

https://github.com/rack/rack

Events

Introduced

b68251c03788ff39d4a4b25424df7360426e4afd

Fixed

e1f22fdbe99afd2126b6fbf05bb12399359574b7

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "3.2.0"
                },
                {
                    "fixed":  "3.2.6"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "cpe":  "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
            "range":  [
                {
                    "introduced":  "3.2.0"
                },
                {
                    "fixed":  "3.2.6"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Affected versions

v3.*

v3.2.0

v3.2.1

v3.2.2

v3.2.3

v3.2.4

v3.2.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26962.json"