Bug 2569574 (CVE-2026-125111)

Summary: CVE-2026-125111 rack: rack: Denial of Service via memory exhaustion in multipart parser
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akostadi, amasferr, crizzo, dmayorov, eglynn, eshamard, jjoyce, jlledo, jpretori, jschluet, jvasik, kaycoth, lhh, mburns, mgarciac, pantinor, rblanco, rhel-process-autobot, tsedmik, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Rack. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending specially crafted multipart requests that exhaust application memory. Because the multipart parser fails to properly clear its internal buffer when chunk boundaries align with part headers, the buffer accumulates data across requests despite configured field limits. This uncontrolled memory consumption can cause the application worker process to crash or become unresponsive.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-10 13:05:57 UTC 
Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can align many small parts with rack.multipart.buffer_size boundaries so the buffer grows with the request despite per-field, header, and preamble limits, causing a worker to exhaust memory. The attack requires only a well-formed multipart body and affects applications that parse multipart requests. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8.