Most recent entries from all

bdu:2026-07729

BREW-mailcatcher-CVE-2026-34829 — Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads

Affected: Homebrew: mailcatcher

## Summary

`Rack::Multipart::Parser` only wraps the request body in a `BoundedIO` when `CONTENT_LENGTH` is present. When a `multipart/form-data` request is sent without a `Content-Length` header, such as with HTTP chunked transfer encoding, multipart parsing continues until end-of-stream with no total size limit.

For file parts, the uploaded body is written directly to a temporary file on disk rather than being constrained by the buffered in-memory upload limit. An unauthenticated attacker can therefore stream an arbitrarily large multipart file upload and consume unbounded disk space.

This results in a denial of service condition for Rack applications that accept multipart form data.

## Details

`Rack::Multipart::Parser.parse` applies `BoundedIO` only when `content_length` is not `nil`:

```ruby io = BoundedIO.new(io, content_length) if content_length ```

When `CONTENT_LENGTH` is absent, the parser reads the multipart body until EOF without a global byte limit.

Although Rack enforces `BUFFERED_UPLOAD_BYTESIZE_LIMIT` for retained non-file parts, file uploads are handled differently. When a multipart part includes a filename, the body is streamed to a `Tempfile`, and the retained-size accounting is not applied to that file content. As a result, file parts are not subject to the same upload size bound.

An attacker can exploit this by sending a chunked `multipart/form-data` request containing a file part and continuously streaming data without declaring a `Content-Length…

EUVD-2026-337301

fkie_cve-2026-34829

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Multipart::Parser only wraps the request body in a BoundedIO when CONTENT_LENGTH is present. When a multipart/form-data request is sent without a Content-Length header, such as with HTTP chunked transfer encoding, multipart parsing continues until end-of-stream with no total size limit. For file parts, the uploaded body is written directly to a temporary file on disk rather than being constrained by the buffered in-memory upload limit. An unauthenticated attacker can therefore stream an arbitrarily large multipart file upload and consume unbounded disk space. This results in a denial of service condition for Rack applications that accept multipart form data. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.

GHSA-8vqr-qjwx-82mw — Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads

Affected: RubyGems: rack

## Summary

This results in a denial of service condition for Rack applications that accept multipart form data.

## Details

`Rack::Multipart::Parser.parse` applies `BoundedIO` only when `content_length` is not `nil`:

```ruby io = BoundedIO.new(io, content_length) if content_length ```

When `CONTENT_LENGTH` is absent, the parser reads the multipart body until EOF without a global byte limit.

An attacker can exploit this by sending a chunked `multipart/form-data` request containing a file part and continuously streaming data without declaring a `Content-Length…

openSUSE-SU-2026:10508-1 — ruby4.0-rubygem-rack-2.2-2.2.23-1.1 on GA media

ruby4.0-rubygem-rack-2.2-2.2.23-1.1 on GA media

SUSE-SU-2026:23321-1 — Security update for rmt-server

Security update for rmt-server

UBUNTU-CVE-2026-34829

Affected: Ubuntu:Pro:14.04:LTS: ruby-rack, Ubuntu:Pro:16.04:LTS: ruby-rack, Ubuntu:Pro:18.04:LTS: ruby-rack, Ubuntu:Pro:22.04:LTS: ruby-rack, Ubuntu:24.04:LTS: ruby-rack, Ubuntu:25.10: ruby-rack, Ubuntu:26.04:LTS: ruby-rack

WID-SEC-W-2026-1687 — IBM License Metric Tool: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM License Metric Tool ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.