Rack, the Ruby web server interface, uses a greedy regular expression to extract the boundary parameter from multipart/form-data. When a Content-Type header contains multiple boundary parameters, Rack incorrectly selects the last one instead of the first. This mismatch allows an attacker to embed multipart content that passes through upstream proxies, WAFs, or other intermediaries while Rack interprets a different body structure. The result is a potential bypass of upstream inspection, enabling malicious data to reach the application with little to no filtering.

The vulnerability affects the Rack web server framework. Versions prior to 2.2.23, 3.1.21, and 3.2.6 are impacted. Updating to the specified patched releases resolves the issue.

The CVSS score of 3.7 indicates a low severity but the flaw can be exploited remotely via crafted HTTP requests that deliver multiple boundary parameters. No exploit probability score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to send a specially crafted request that passes through an upstream inspection system that follows the first boundary parameter, while Rack uses the last parameter, allowing content to bypass the intermediary checks.