The guard added for CVE-2026-26961 (GHSA-vgpv-f759-9wx3), which rejects multipart requests with more than one boundary parameter, only inspects the part of the Content-Type header after the boundary it extracts. A Content-Type whose first boundary parameter is empty or begins with a quote, semicolon, or comma is skipped by the extraction pattern, so a second boundary parameter is accepted silently and Rack parses the body with a boundary that a conforming parser would not derive from the header.

Impact

As with CVE-2026-26961, an attacker can craft a multipart request that a web application firewall or other inspecting proxy in front of a Rack application interprets differently from Rack, so form fields and file uploads reach the application without inspection. Rack itself grants no capability beyond that of a well-formed request with the same body. All supported versions, including 2.2, are affected.