CVE-2022-44570: Denial of service via header parsing in Rack

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-02-09 · updated 2026-06-17
Weakness: CWE-400

Description

A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.

Affected products

rack: from 1.5.0 before 2.0.9.2; from 2.1.0 before 2.1.4.2; from 2.2.0 before 2.2.6.1; from 3.0.0 before 3.0.4.1 — fixed in 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.4.1
Rubygems Rack: from 1.5.0 before 2.0.9.2; from 2.1.0.0 before 2.1.4.2; from 2.2.0.0 before 2.2.6.2; from 3.0.0.0 before 3.0.4.1; 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5 (+48) — fixed in 2.0.9.2, 2.1.4.2, 2.2.6.2, 3.0.4.1

How to fix

Upgrade to a fixed version: rack 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.4.1; Rubygems Rack 2.0.9.2, 2.1.4.2, 2.2.6.2, 3.0.4.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-44570 or the next vulnerability affects your stack