Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads

The core of the vulnerability lies in how Rack::Multipart::Parser handles requests without a Content-Length header, particularly when using HTTP chunked transfer encoding. Normally, the parser would limit the size of uploaded files. However, due to a flaw in the logic, the parser doesn't enforce this limit when the Content-Length header is missing. This allows an attacker to stream an arbitrarily large multipart file directly to disk, bypassing the intended size restrictions. The primary impact is denial of service (DoS) through disk exhaustion, as the attacker can fill up the server's storage space. While direct code execution isn't immediately possible, a sufficiently large uploaded file could potentially trigger other vulnerabilities or instability within the application or server.

1. Gereserveerd2026-03-30
2. Gepubliceerd2026-04-02
3. Gewijzigd2026-04-06
4. EPSS bijgewerkt2026-04-10

The primary mitigation for CVE-2026-34829 is to upgrade to Rack version 2.2.23 or later, which includes the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing temporary workarounds. One approach is to configure a web application firewall (WAF) or reverse proxy to enforce strict file size limits on multipart uploads, regardless of the Content-Length header. Another workaround involves modifying the Rack application to explicitly check and reject uploads exceeding a reasonable size threshold. Monitor disk space usage closely to detect potential exploitation attempts. After upgrading, confirm the fix by attempting a large multipart upload and verifying that the upload is rejected with an appropriate error message.