Resource exhaustion in Rack - #VU159495
Published: November 5, 2026
Vulnerability details
The vulnerability allows an unauthenticated attacker to cause denial of service through memory exhaustion in applications that parse multipart requests with Rack, including in the default configuration. A single well-formed multipart request can retain memory proportional to its size for the duration of parsing, exhausting worker memory.
The vulnerability exists due to Rack::Multipart::Parser retaining already parsed data in its internal scan buffer when chunk boundaries fall inside or immediately after part headers. A remote attacker can submit a well-formed multipart body with parts sized to fit within individual chunks and aligned so that every chunk ends at these positions, preventing buffer compaction and causing the buffer to grow to the size of the request. The parser appends input chunks to a StringScanner and advances through boundaries, headers, and bodies. It removes the consumed prefix in the body state when no closing boundary is found, but requests more data without removing consumed bytes in the header state or in the body state before any body bytes have been consumed.
Chunks are controlled by rack.multipart.buffer_size, which defaults to 1 MiB. Bytes skipped between parts are not counted against any limit, and existing limits on buffered non-file field data, header size, and preamble size do not constrain this accumulation because each individual part remains small. With default limits, the scan buffer can reach roughly 4 GiB through 4096 parts of about 1 MiB each. Ordinary file uploads aligned in the same way also retain parsed data, but the file part limit bounds this case at roughly 128 MiB per request.