CVE-2022-44572: Denial of service via multipart parsing in Rack

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-02-09 · updated 2026-06-17
Weakness: CWE-400

Description

A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.

Affected products

rack: before 2.0.9.2; from 2.1.0 before 2.1.4.2; from 2.2.0 before 2.2.4.1 — fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1
Rubygems Rack: from 2.0.0 before 2.0.9.2; from 2.1.0.0 before 2.1.4.2; from 2.2.0.0 before 2.2.6.1; from 3.0.0.0 before 3.0.4.1; 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6 (+23) — fixed in 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.4.1

How to fix

Upgrade to a fixed version: rack 2.0.9.2, 2.1.4.2, 2.2.4.1; Rubygems Rack 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.4.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-44572 or the next vulnerability affects your stack