rack 2.2.23 → 2.2.24

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f1956bc102141711f91a9f0daa1507098bd8b7ede58febde9472b875dcb0d4e4
-  data.tar.gz: a8945afc610aed0c61ce8062e3b1394a24c6a457789637cc6835cfd881dac635
+  metadata.gz: 5905364bd5b40d622e2e10330911370ec92f23e5afa1aa58283c2f0cf9a5782d
+  data.tar.gz: '09c4da33251a32194f0a656767150eaa17367f8e42ee45735971e963d0e43991'
 SHA512:
-  metadata.gz: afe4c41e29d6112ba8fe825b33b93d10317d576add705a72de25825caa504c21eefe86cf9308df573dd422cfb4aed24e9453ad4e92720188f4f98c4d2f04c5c4
-  data.tar.gz: d28cd489644e2191917b28f39d689d384c21296e4f4a8a2bab7b1413f4110cb2092336039afc571d1278adbbfa4ebac9b2d27cb342b873336aa6efe037a93f4d
+  metadata.gz: 5ee4b678c01a6bb97074b87886498d8aa3bce9b61322cb95cc7908dec5e751fdfb8b238bc98956719505b394de21d1f6787d2593378b1fee4a6fe10b9aea3d5b
+  data.tar.gz: 032c32c7ebb220355578577fce8ad49c67f869b0ba60e533c3e1178b3265086d50e34de0912f00dc9bfdfb4042d446bc2b1ac8bc62916835521b4cf3786de341

data/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference [Keep A Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [2.2.24] - 2026-08-13
+
+### Security
+
+- [CVE-2026-26962](https://github.com/advisories/GHSA-rx22-g9mx-qrhv) Improper unfolding of folded multipart headers preserves CRLF in parsed parameter values.
+
 ## [2.2.23] - 2026-04-01
 
 ### Security

data/lib/rack/multipart/parser.rb

@@ -24,6 +24,10 @@ module Rack
       private_constant :BOUNDARY_START_LIMIT
 
       MIME_HEADER_BYTESIZE_LIMIT = 64 * 1024
+
+      OBS_UNFOLD = /\r\n([ \t])/
+
+      private_constant :OBS_UNFOLD
       private_constant :MIME_HEADER_BYTESIZE_LIMIT
 
       env_int = lambda do |key, val|
@@ -310,14 +314,17 @@ module Rack
       def handle_mime_head
         if @sbuf.scan_until(@head_regex)
           head = @sbuf[1]
-          content_type = head[MULTIPART_CONTENT_TYPE, 1]
-          if name = head[MULTIPART_CONTENT_DISPOSITION, 1]
+          # Implement OBS unfolding (RFC 5322 Section 2.2.3). Done on a copy
+          # because content type, disposition and filename are extracted by regex.
+          unfolded_head = head.gsub(OBS_UNFOLD, '\\1')
+          content_type = unfolded_head[MULTIPART_CONTENT_TYPE, 1]
+          if name = unfolded_head[MULTIPART_CONTENT_DISPOSITION, 1]
             name = Rack::Auth::Digest::Params::dequote(name)
           else
-            name = head[MULTIPART_CONTENT_ID, 1]
+            name = unfolded_head[MULTIPART_CONTENT_ID, 1]
           end
 
-          filename = get_filename(head)
+          filename = get_filename(unfolded_head)
 
           if name.nil? || name.empty?
             name = filename || "#{content_type || TEXT_PLAIN}[]".dup

data/lib/rack/version.rb

@@ -20,7 +20,7 @@ module Rack
     VERSION.join(".")
   end
 
-  RELEASE = "2.2.23"
+  RELEASE = "2.2.24"
 
   # Return the Rack release as a dotted string.
   def self.release

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack
 version: !ruby/object:Gem::Version
-  version: 2.2.23
+  version: 2.2.24
 platform: ruby
 authors:
 - Leah Neukirchen
@@ -182,7 +182,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.10
 specification_version: 4
 summary: A modular Ruby webserver interface.
 test_files: []