--- title: GHSA-5v64-555j-wjxm (rack): Multipart parser retains... description: Rack's multipart parser can be forced to retain the entire request body in memory, causing denial of service. The parser reads the body in chunks (1 MiB by... canonical: https://daily.dev/posts/ghsa-5v64-555j-wjxm-rack-multipart-parser-retains-parsed-data-in-its-scan-buffer-allowing-denial-9ngr4ua7u twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GHSA-5v64-555j-wjxm (rack): Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion. | daily.dev og:description: Rack's multipart parser can be forced to retain the entire request body in memory, causing denial of service. The parser reads the body in chunks (1 MiB by... og:url: https://daily.dev/posts/ghsa-5v64-555j-wjxm-rack-multipart-parser-retains-parsed-data-in-its-scan-buffer-allowing-denial-9ngr4ua7u og:image: https://api.daily.dev/og/posts/9ngR4Ua7u.png og:image:alt: GHSA-5v64-555j-wjxm (rack): Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GHSA-5v64-555j-wjxm (rack): Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion. **[RUBYLAND](https://daily.dev/sources/rubyla)** · 1 min read · 0 upvotes · 0 comments ## Summary Rack's multipart parser can be forced to retain the entire request body in memory, causing denial of service. The parser reads the body in chunks (1 MiB by default) into a scan buffer, but only discards parsed bytes when a chunk ends inside a part body. An attacker can craft a multipart request where every chunk ends inside or right after a part's headers, so the buffer never gets compacted and grows to the request's full size. This affects any Rack application parsing multipart requests in its default configuration, and requires no authentication. The issue carries a CVSS score of 7.5 (High) and is fixed in Rack 2.2.25, 3.1.23, and 3.2.8. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What Rack versions fix the multipart parser memory exhaustion vulnerability GHSA-5v64-555j-wjxm? Rack versions 2.2.25, 3.1.23, and 3.2.8 fix the vulnerability. The flaw lets an unauthenticated attacker send a crafted multipart request whose chunks always end inside or right after part headers, preventing the scan buffer from being compacted so it grows to the full request size, exhausting worker memory. The issue has a CVSS score of 7.5 (High). _Teams tracking Ruby dependency CVEs like this one can follow patch advisories on daily.dev._ ### Why does Rack's multipart parser consume unbounded memory during a DoS attack? Rack::Multipart::Parser reads the request body in chunks of rack.multipart.buffer_size, 1 MiB by default, into an internal scan buffer, but only discards parsed bytes when a chunk happens to end inside a part's body. If every chunk ends inside or just after a part's headers instead, the buffer is never compacted and grows proportional to the request size, exhausting memory. _Developers debugging memory exhaustion in Ruby web apps can track advisories like this on daily.dev._ ## Similar posts on daily.dev - [CVE-2026-111181: Denial of service in body-parser](https://daily.dev/posts/cve-2026-111181-denial-of-service-in-body-parser-narogjw7n) · Express.js · 0 upvotes · 0 comments - [GHSA-42qh-8mx8-7wqm \(rack-proxy\): HTTP response smuggling via ambiguous backend response framing in rack-proxy 1.x](https://daily.dev/posts/ghsa-42qh-8mx8-7wqm-rack-proxy-http-response-smuggling-via-ambiguous-backend-response-framing-in--dgy8hoi4b) · RUBYLAND · 0 upvotes · 0 comments - [Post Mortem: HTTP Request Smuggling Vulnerability](https://daily.dev/posts/post-mortem-http-request-smuggling-vulnerability-36fsdzezd) · Crystal · 7 upvotes · 0 comments - [Improper parsing of W3C baggage headers may lead to DoS](https://daily.dev/posts/improper-parsing-of-w3c-baggage-headers-may-lead-to-dos-unmzdvdu5) · RUBYLAND · 0 upvotes · 0 comments - [Unbounded memory allocation in RFC6587SyslogDeserializer \(octet-counted framing\) — remote DoS](https://daily.dev/posts/unbounded-memory-allocation-in-rfc6587syslogdeserializer-octet-counted-framing-remote-dos-fktfnzmbj) · Spring · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#ruby](https://daily.dev/tags/ruby) [View this post on daily.dev](https://daily.dev/posts/ghsa-5v64-555j-wjxm-rack-multipart-parser-retains-parsed-data-in-its-scan-buffer-allowing-denial-9ngr4ua7u) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GHSA-5v64-555j-wjxm (rack): Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.","url":"https://daily.dev/posts/ghsa-5v64-555j-wjxm-rack-multipart-parser-retains-parsed-data-in-its-scan-buffer-allowing-denial-9ngr4ua7u","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ghsa-5v64-555j-wjxm-rack-multipart-parser-retains-parsed-data-in-its-scan-buffer-allowing-denial-9ngr4ua7u"},"datePublished":"2026-10-31T15:21:08.058Z","dateModified":"2026-10-31T15:21:31.270Z","description":"Rack's multipart parser can be forced to retain the entire request body in memory, causing denial of service. The parser reads the body in chunks (1 MiB by...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"RUBYLAND","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"RUBYLAND","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/rubyla","url":"https://daily.dev/sources/rubyla"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ghsa-5v64-555j-wjxm-rack-multipart-parser-retains-parsed-data-in-its-scan-buffer-allowing-denial-9ngr4ua7u","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,ruby","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"RUBYLAND","item":"https://daily.dev/sources/rubyla"},{"@type":"ListItem","position":3,"name":"GHSA-5v64-555j-wjxm (rack): Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion."}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ghsa-5v64-555j-wjxm-rack-multipart-parser-retains-parsed-data-in-its-scan-buffer-allowing-denial-9ngr4ua7u#faq","mainEntity":[{"@type":"Question","name":"What Rack versions fix the multipart parser memory exhaustion vulnerability GHSA-5v64-555j-wjxm?","acceptedAnswer":{"@type":"Answer","text":"Rack versions 2.2.25, 3.1.23, and 3.2.8 fix the vulnerability. The flaw lets an unauthenticated attacker send a crafted multipart request whose chunks always end inside or right after part headers, preventing the scan buffer from being compacted so it grows to the full request size, exhausting worker memory. The issue has a CVSS score of 7.5 (High). Teams tracking Ruby dependency CVEs like this one can follow patch advisories on daily.dev."}},{"@type":"Question","name":"Why does Rack's multipart parser consume unbounded memory during a DoS attack?","acceptedAnswer":{"@type":"Answer","text":"Rack::Multipart::Parser reads the request body in chunks of rack.multipart.buffer_size, 1 MiB by default, into an internal scan buffer, but only discards parsed bytes when a chunk happens to end inside a part's body. If every chunk ends inside or just after a part's headers instead, the buffer is never compacted and grows proportional to the request size, exhausting memory. Developers debugging memory exhaustion in Ruby web apps can track advisories like this on daily.dev."}}]} ```