CVE-2026-34827

CVE-2026-34827 is a high-severity denial of service vulnerability affecting Rack, a Ruby web server interface, in versions 3.0.0.beta1 through 3.1.20 and 3.2.0 through 3.2.5. This flaw allows an unauthenticated attacker to remotely trigger excessive CPU usage by sending a crafted multipart form-data request containing numerous backslash-escaped parameter values. The inefficient parsing of these values leads to super-linear processing, resulting in a denial of service condition for affected applications. With a CVSS score of 7.5 (High), the attack complexity is low. There is currently no evidence of active exploitation or public exploit code, though the vulnerability has received minor community discussion, and patches are available in Rack versions 3.1.21 and 3.2.6.