SECUFOCUSNOW
Home›CVE index›CVE-2026-34827
Review reviewHigh

CVE-2026-34827

rack rack, Logging Subsystem for Red Hat OpenShift, Red Hat 3scale API Management Platform 2

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Multipart::Parser#handle_mime_head parses quoted multipart parameters such as Content-Disposition: form-data; name="..." using repeated String#index searches combined with String#slice! prefix deletion. For escape-heavy quoted values, this causes super-linear processing. An unauthenticated attacker can send a crafted multipart/form-data request containing many parts with long backslash-escaped parameter values to trigger excessive CPU usage during multipart parsing. This...

CVSS
7.5
EPSS
0.47%
38.6% percentile
CISA KEV
Not listed
Published
2026.04.03
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.47%
Technical severityCVSS 7.5

Vulnerability overview

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Multipart::Parser#handle_mime_head parses quoted multipart parameters such as Content-Disposition: form-data; name="..." using repeated String#index searches combined with String#slice! prefix deletion. For escape-heavy quoted values, this causes super-linear processing. An unauthenticated attacker can send a crafted multipart/form-data request containing many parts with long backslash-escaped parameter values to trigger excessive CPU usage during multipart parsing. This...

Affected product and versions

Product
rack rack, Logging Subsystem for Red Hat OpenShift, Red Hat 3scale API Management Platform 2
Affected versions
>= >= 3.0.0.beta1, < 3.1.21, >= >= 3.2.0, < 3.2.6, >= 3.0.0 < 3.1.21, >= 3.2.0 < 3.2.6
Fixed versions
3.1.21, 3.2.6

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that rack rack, Logging Subsystem for Red Hat OpenShift, Red Hat 3scale API Management Platform 2 and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
CWE-400, CWE-407, CWE-770