{"id":"EM-20261110-RQBH","url":"https://cyber.eventmonitor.net/incident/EM-20261110-RQBH/rack-vulnerability-cve-2026-125111/","type":"cve","title":"Rack Vulnerability (CVE-2026-125111)","subtitle":"CVE-2026-125111","subject":"CVE-2026-125111","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-10T19:35:49.000Z","firstSignal":"2026-11-09T22:18:42.433Z","lastSignal":"2026-11-10T19:35:49.000Z","updated":"2026-11-10T20:23:48.430Z","revision":1,"life":[{"status":"Born","at":"2026-11-10T19:35:49.000Z","why":"second independent source: C26 GitHub Advisory Database"},{"status":"Developing","at":"2026-11-10T19:35:49.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-09T22:18:42.433Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-10T19:35:49.000Z","what":"Born: second source, C26 GitHub Advisory Database. Page EM-20261110-RQBH created."}],"stages":[{"name":"Disclosed","at":"2026-11-09T22:18:42.433Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-09T22:18:42.433Z","detail":"CVSS 7.5 · EPSS 0.4%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-09T22:18:42.433Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-125111 (CVSS 7.5)","text":"Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can align many small parts with rack.multipart.buffer_size boundaries so the buffer grows with the request despite per-field, header, and preamble limits, causing a worker to exhaust memory. The attack requires only a well-formed multipart body and affects applications that parse multipart requests. This issue is fixed in versions 2.2.25…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125111"},{"at":"2026-11-10T19:35:49.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":3,"title":"GHSA-5v64-555j-wjxm / CVE-2026-125111: Rack: Multipart parsing allows DoS via unbounded scan buffer growth","text":"rubygems:rack, rubygems:rack, rubygems:rack","url":"https://github.com/advisories/GHSA-5v64-555j-wjxm"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-09T22:18:42.433","score":7.5,"severity":"HIGH","desc":"Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Multipart::Parser can retain parsed data in its internal StringScanner buffer when reads end inside or immediately after multipart headers. An unauthenticated attacker can align many small parts with…","product":"","seen":1794273221013},"kev":null,"epss":{"epss":0.00366,"pct":0.30734,"at":1794342228430},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}