Rack's Multipart boundary parser can skip a leading empty or quoted boundary parameter in a multipart Content‑Type header, then accept a later boundary. This is an example of CWE‑436, improper handling of empty parameters. The flaw allows a request body that a conforming intermediary would normally reject to be parsed by the application, letting form fields or file uploads reach the target without passing through any proxy or web application firewall inspection. The flaw therefore provides a straightforward way to bypass WAF rules that rely on standard boundary handling, compromising the integrity of deployed security controls.

Ruby web applications built on the Rack framework. Versions prior to 2.2.25, 3.1.23, and 3.2.8 contain the vulnerable parser implementation and are affected.

The CVSS score of 3.7 indicates low severity, and the vulnerability is not listed in CISA's KEV catalog. EPSS data is not available. Exploitation requires only that an attacker can send a crafted HTTP request with a quoted multipart boundary, which can be done with readily available tools. The attack vector is therefore remote via HTTP request injection, and the flaw can be used to stealthily deliver malicious payloads that bypass intermediary security controls.