Read the docs
TI-2022-21911 Aliases CVE-2022-44571GHSA-93pm-5p5f-3ghx

Uncontrolled resource consumption in https://github.com/rack/rack

Priority LOW 36CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an attacker to craft an input that can cause Content-Disposition header parsing in Rackto take an unexpected amount of time, possibly resulting in a denial ofservice attack vector. This header is used typically used in multipartparsing. Any applications that parse multipart posts using Rack (virtuallyall Rails applications) are impacted.

Why it matters now

EPSS 0.01503 74th percentileScored 2026-11-07
Fix Fixed rack (RubyGems): 2.0.9.2, 2.1.4.2, 2.2.6.1 +1Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—https://github.com/rack/rack2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1—No fix listedCNA
—rack (RubyGems)2.0.0 to before 2.0.9.22.0.9.2Patch availableGHSA-93pm-5p5f-3ghx
—rack (RubyGems)2.1.0 to before 2.1.4.22.1.4.2Patch availableGHSA-93pm-5p5f-3ghx
—rack (RubyGems)2.2.0 to before 2.2.6.12.2.6.1Patch availableGHSA-93pm-5p5f-3ghx
—rack (RubyGems)3.0.0.0 to before 3.0.4.13.0.4.1Patch availableGHSA-93pm-5p5f-3ghx
  • https://github.com/rack/rack Vendor— Affected 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1 Fixed in — No fix listed CNA
  • rack (RubyGems) Vendor— Affected 2.0.0 to before 2.0.9.2 Fixed in 2.0.9.2 Patch available GHSA-93pm-5p5f-3ghx
  • rack (RubyGems) Vendor— Affected 2.1.0 to before 2.1.4.2 Fixed in 2.1.4.2 Patch available GHSA-93pm-5p5f-3ghx
  • rack (RubyGems) Vendor— Affected 2.2.0 to before 2.2.6.1 Fixed in 2.2.6.1 Patch available GHSA-93pm-5p5f-3ghx
  • rack (RubyGems) Vendor— Affected 3.0.0.0 to before 3.0.4.1 Fixed in 3.0.4.1 Patch available GHSA-93pm-5p5f-3ghx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*2.0.0 to before 2.0.9.2; 2.1.0 to before 2.1.4.2; 2.2.0 to before 2.2.6.1; 3.0.0.0 to before 3.0.4.1Vulnerablerack
  • cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:* Versions 2.0.0 to before 2.0.9.2; 2.1.0 to before 2.1.4.2; 2.2.0 to before 2.2.6.1; 3.0.0.0 to before 3.0.4.1 Vulnerable ·rack

Remediation

  • Fix · GHSA-93pm-5p5f-3ghx rack (RubyGems) Fixed in 2.0.9.2 Advisory →
  • Fix · GHSA-93pm-5p5f-3ghx rack (RubyGems) Fixed in 2.1.4.2 Advisory →
  • Fix · GHSA-93pm-5p5f-3ghx rack (RubyGems) Fixed in 2.2.6.1 Advisory →
  • Fix · GHSA-93pm-5p5f-3ghx rack (RubyGems) Fixed in 3.0.4.1 Advisory →

Red Hat 1 advisory

  • RHSA-2023:6818 Released 2023-11-08 · Red Hat rating Important
    Satellite 6.14 security and bug fix update
    • Red Hat Satellite 6.14 for RHEL 8 foreman-3.7.0.9-1.el8sat, foreman-cli-3.7.0.9-1.el8sat, foreman-debug-3.7.0.9-1.el8sat +33

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 6.14 for RHEL 8Fixed RHSA-2023:6818
Not affected: 1 product
  • Red Hat Satellite 6.14 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-44571
  2. 2026-10-03 Alias added: GHSA-93pm-5p5f-3ghx

References

Patch 1

Advisory 2

Other 4

  • TI-2024-16580 Rack ReDos in content type parsing (2nd degree polynomial) CVSS 3.1HIGH 7.5
  • TI-2024-17236 Possible Denial of Service Vulnerability in Rack Header Parsing CVSS 3.1HIGH 7.5
  • TI-2024-17231 Possible DoS Vulnerability with Range Header in Rack CVSS 3.1HIGH 7.5
  • TI-2023-12254 Uncontrolled resource consumption in https://github.com/rack/rack CVSS 3.1HIGH 7.5
  • TI-2025-38165 Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) CVSS 3.1HIGH 7.5
  • TI-2025-38163 Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) CVSS 3.1HIGH 7.5
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences