UBUNTU-CVE-2026-26962

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-26962

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-26962.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-26962

Upstream

CVE-2026-26962

Downstream

USN-8182-1

Published

2026-04-02T18:16:00Z

Modified

2026-04-17T10:34:11.707502Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

Rack is a modular Ruby web server interface. From version 3.2.0 to before version 3.2.6, Rack::Multipart::Parser unfolds folded multipart part headers incorrectly. When a multipart header contains an obs-fold sequence, Rack preserves the embedded CRLF in parsed parameter values such as filename or name instead of removing the folded line break during unfolding. As a result, applications that later reuse those parsed values in HTTP response headers may be vulnerable to downstream header injection or response splitting. This issue has been patched in version 3.2.6.

References

Affected packages

Ubuntu:22.04:LTS

ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack@2.1.4-5ubuntu1.2?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.1.4-3

2.1.4-4

2.1.4-5

2.1.4-5ubuntu1

2.1.4-5ubuntu1.1

2.1.4-5ubuntu1.2

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "2.1.4-5ubuntu1.2",
            "binary_name": "ruby-rack"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-26962.json"

Ubuntu:24.04:LTS

ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack@2.2.7-1ubuntu0.7?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.2.4-3

2.2.7-1

2.2.7-1ubuntu0.1

2.2.7-1ubuntu0.2

2.2.7-1ubuntu0.3

2.2.7-1ubuntu0.4

2.2.7-1ubuntu0.5

2.2.7-1ubuntu0.6

2.2.7-1ubuntu0.7

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "2.2.7-1ubuntu0.7",
            "binary_name": "ruby-rack"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-26962.json"

Ubuntu:25.10

ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack@3.1.16-0.1ubuntu0.3?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.2.7-1.1

3.*

3.1.16-0.1

3.1.16-0.1ubuntu0.1

3.1.16-0.1ubuntu0.2

3.1.16-0.1ubuntu0.3

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "3.1.16-0.1ubuntu0.3",
            "binary_name": "ruby-rack"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-26962.json"

Ubuntu:Pro:14.04:LTS

ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack@1.5.2-3+deb8u3ubuntu1~esm11?arch=source&distro=esm-infra-legacy/trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.5.2-1

1.5.2-1ubuntu0.1~esm1

1.5.2-3+deb8u3ubuntu1~esm2

1.5.2-3+deb8u3ubuntu1~esm3

1.5.2-3+deb8u3ubuntu1~esm4

1.5.2-3+deb8u3ubuntu1~esm6

1.5.2-3+deb8u3ubuntu1~esm7

1.5.2-3+deb8u3ubuntu1~esm8

1.5.2-3+deb8u3ubuntu1~esm9

1.5.2-3+deb8u3ubuntu1~esm10

1.5.2-3+deb8u3ubuntu1~esm11

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "1.5.2-3+deb8u3ubuntu1~esm11",
            "binary_name": "librack-ruby"
        },
        {
            "binary_version": "1.5.2-3+deb8u3ubuntu1~esm11",
            "binary_name": "librack-ruby1.8"
        },
        {
            "binary_version": "1.5.2-3+deb8u3ubuntu1~esm11",
            "binary_name": "librack-ruby1.9.1"
        },
        {
            "binary_version": "1.5.2-3+deb8u3ubuntu1~esm11",
            "binary_name": "ruby-rack"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-26962.json"

Ubuntu:Pro:16.04:LTS

ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack@1.6.4-3ubuntu0.2+esm10?arch=source&distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.5.2-4

1.6.4-2

1.6.4-3

1.6.4-3ubuntu0.1

1.6.4-3ubuntu0.2

1.6.4-3ubuntu0.2+esm1

1.6.4-3ubuntu0.2+esm2

1.6.4-3ubuntu0.2+esm4

1.6.4-3ubuntu0.2+esm5

1.6.4-3ubuntu0.2+esm6

1.6.4-3ubuntu0.2+esm7

1.6.4-3ubuntu0.2+esm8

1.6.4-3ubuntu0.2+esm9

1.6.4-3ubuntu0.2+esm10

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "1.6.4-3ubuntu0.2+esm10",
            "binary_name": "ruby-rack"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-26962.json"

Ubuntu:Pro:18.04:LTS

ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack@1.6.4-4ubuntu0.2+esm10?arch=source&distro=esm-apps/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.6.4-4

1.6.4-4ubuntu0.1

1.6.4-4ubuntu0.2

1.6.4-4ubuntu0.2+esm1

1.6.4-4ubuntu0.2+esm2

1.6.4-4ubuntu0.2+esm4

1.6.4-4ubuntu0.2+esm5

1.6.4-4ubuntu0.2+esm6

1.6.4-4ubuntu0.2+esm7

1.6.4-4ubuntu0.2+esm8

1.6.4-4ubuntu0.2+esm9

1.6.4-4ubuntu0.2+esm10

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "1.6.4-4ubuntu0.2+esm10",
            "binary_name": "ruby-rack"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-26962.json"

Ubuntu:Pro:20.04:LTS

ruby-rack

Package

Name: ruby-rack
Purl: pkg:deb/ubuntu/ruby-rack@2.0.7-2ubuntu0.1+esm10?arch=source&distro=esm-apps/focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.0.6-3

2.0.7-2

2.0.7-2ubuntu0.1

2.0.7-2ubuntu0.1+esm1

2.0.7-2ubuntu0.1+esm2

2.0.7-2ubuntu0.1+esm3

2.0.7-2ubuntu0.1+esm4

2.0.7-2ubuntu0.1+esm5

2.0.7-2ubuntu0.1+esm6

2.0.7-2ubuntu0.1+esm7

2.0.7-2ubuntu0.1+esm8

2.0.7-2ubuntu0.1+esm9

2.0.7-2ubuntu0.1+esm10

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "2.0.7-2ubuntu0.1+esm10",
            "binary_name": "ruby-rack"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-26962.json"