Read the docs
TI-2022-12396 Aliases CVE-2022-30122GHSA-hxqx-xwvh-44m2

Uncontrolled resource consumption in https://github.com/rack/rack

Priority MEDIUM 43CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02231 82nd percentileScored 2026-11-07
Fix Partial rack (RubyGems): 2.0.9.1, 2.1.4.1, 2.2.3.1Red Hat: 2 advisoriesRed Hat: 3 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—https://github.com/rack/rack2.0.9.1, 2.1.4.1, 2.2.3.1—No fix listedCNA
—rack (RubyGems)1.2 to before 2.0.9.12.0.9.1Patch availableGHSA-hxqx-xwvh-44m2
—rack (RubyGems)2.1 to before 2.1.4.12.1.4.1Patch availableGHSA-hxqx-xwvh-44m2
—rack (RubyGems)2.2 to before 2.2.3.12.2.3.1Patch availableGHSA-hxqx-xwvh-44m2
  • https://github.com/rack/rack Vendor— Affected 2.0.9.1, 2.1.4.1, 2.2.3.1 Fixed in — No fix listed CNA
  • rack (RubyGems) Vendor— Affected 1.2 to before 2.0.9.1 Fixed in 2.0.9.1 Patch available GHSA-hxqx-xwvh-44m2
  • rack (RubyGems) Vendor— Affected 2.1 to before 2.1.4.1 Fixed in 2.1.4.1 Patch available GHSA-hxqx-xwvh-44m2
  • rack (RubyGems) Vendor— Affected 2.2 to before 2.2.3.1 Fixed in 2.2.3.1 Patch available GHSA-hxqx-xwvh-44m2

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:rack_project:rack:*:*:*:*:*:*:*:*1.2 to before 2.0.9.1; 2.1.0 to before 2.1.4.1; 2.2.0 to before 2.2.3.1VulnerableRack Project
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:rack_project:rack:*:*:*:*:*:*:*:* Versions 1.2 to before 2.0.9.1; 2.1.0 to before 2.1.4.1; 2.2.0 to before 2.2.3.1 Vulnerable ·Rack Project
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-hxqx-xwvh-44m2 rack (RubyGems) Fixed in 2.0.9.1 Advisory →
  • Fix · GHSA-hxqx-xwvh-44m2 rack (RubyGems) Fixed in 2.1.4.1 Advisory →
  • Fix · GHSA-hxqx-xwvh-44m2 rack (RubyGems) Fixed in 2.2.3.1 Advisory →

Red Hat 2 advisories

  • RHSA-2023:1486 Released 2023-03-28 · Red Hat rating Important
    Red Hat Gluster Storage web-admin-build security update
    • Red Hat Gluster 3.5 Web Administration on RHEL-7 grafana-5.2.4-6.el7rhgs, rubygem-puma-4.3.12-1.el7rhgs, rubygem-puma-doc-4.3.12-1.el7rhgs +4
  • RHSA-2022:7242 Released 2022-10-27 · Red Hat rating Important
    Satellite 6.11.4 Async Security Update
    • Red Hat Satellite 6.11 for RHEL 7 tfm-rubygem-rack-2.2.3.1-1.el7sat, tfm-rubygem-tzinfo-1.2.10-1.el7sat
    • Red Hat Satellite 6.11 for RHEL 8 rubygem-rack-2.2.3.1-1.el8sat, rubygem-tzinfo-1.2.10-1.el8sat

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    https://github.com/rack/rack — GLSA-202310-18

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2022-12397 A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which…Priority MEDIUM 47
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Gluster 3.5 Web Administration on RHEL-7Fixed RHSA-2023:1486
Red Hat Satellite 6.11 for RHEL 7Fixed RHSA-2022:7242
Red Hat Satellite 6.11 for RHEL 8Fixed RHSA-2022:7242
Not affected: 3 products
  • Red Hat Gluster 3.5 Web Administration on RHEL-7
  • Red Hat Satellite 6.11 for RHEL 7
  • Red Hat Satellite 6.11 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-30122
  2. 2026-10-03 Alias added: GHSA-hxqx-xwvh-44m2

References

Advisory 5

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences