Rack’s multipart parser uses a greedy regular expression that extracts the boundary parameter from a Content‑Type header by selecting the last value rather than the first. This parsing flaw constitutes a boundary ambiguity weakness (CWE‑444) and an incorrect data extraction weakness (CWE‑436). When a request contains multiple boundary parameters, upstream proxies, Web Application Firewalls, or other intermediaries that interpret the first parameter may apply filtering logic based on that boundary, while Rack itself parses the request using the second parameter. The result is that malicious multipart payloads can slip past upstream inspection and be processed by the application, potentially exposing the system to data injection or other payload-based attacks.

The issue affects the Rack Ruby web server interface. All versions earlier than 2.2.23, 3.1.21, and 3.2.6 are vulnerable. Deployments running these older releases are at risk until they are updated to the patched versions.

The CVSS base score of 3.7 indicates a low severity vulnerability, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to send a specially crafted multipart/form‑data HTTP request that contains two boundary parameters; the WAF or proxy will use the first boundary while Rack will use the second, enabling the attacker to smuggle unwanted content past upstream controls.