CVE-2026-125111

{
  "etk_id": "ETK-2026-4000",
  "cve_id": "CVE-2026-125111",
  "display_id": "CVE-2026-125111",
  "ghsa_id": "GHSA-5v64-555j-wjxm",
  "euvd_id": "EUVD-2026-120485",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unbounded memory consumption in Rack multipart parsing",
  "summary": "Rack versions before 2.2.25, 3.1.23, and 3.2.8 can consume excessive memory when processing multipart requests. An unauthenticated remote attacker may exhaust application worker memory if the application accepts and parses multipart request bodies.",
  "mitigation": "Upgrade rack to 2.2.25, 3.1.23, or 3.2.8, as appropriate for the supported release line.",
  "vendor": "rack",
  "product": "rack",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 2.2.25"
      ],
      "ecosystem": "rubygems",
      "fixed_versions": [
        "2.2.25"
      ],
      "package_name": "rack",
      "purl": "pkg:gem/rack"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.0, < 3.1.23"
      ],
      "ecosystem": "rubygems",
      "fixed_versions": [
        "3.1.23"
      ],
      "package_name": "rack",
      "purl": "pkg:gem/rack"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.2, < 3.2.8"
      ],
      "ecosystem": "rubygems",
      "fixed_versions": [
        "3.2.8"
      ],
      "package_name": "rack",
      "purl": "pkg:gem/rack"
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 8.73640405,
  "t0_at": "2026-11-09T22:02:38.334000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-09T22:33:00.701290+00:00",
      "days": 0.021092214004629628,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T22:02:38.334000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-30T02:18:55+00:00",
      "days": -10.822029328703703,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T22:02:38.334000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-125111"
    }
  }
}