CVE catalog

CVE-2022-44572

ruby-rack: CVE-2022-44572

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.62% · Oct 25, 2026

A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-racksid3.2.7-1fixed
Debianruby-rackforky3.2.7-1fixed
Debianruby-racktrixie3.1.20-0+deb13u1fixed
Debianruby-racktrixie-security3.1.20-0+deb13u2fixed
Debianruby-rackbookworm2.2.22-0+deb12u1fixed
Debianruby-rackbookworm-security2.2.22-0+deb12u2fixed
Ubunturuby-rackpro2.1.4-3vulnerable
Ubunturuby-rackpro2.1.4-4vulnerable
Ubunturuby-rackpro2.1.4-5vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm2vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm3fixed
Ubunturuby-rack22.042.1.4-3vulnerable
Ubunturuby-rack22.042.1.4-4vulnerable
Ubunturuby-rack22.042.1.4-5vulnerable
Ubunturuby-rack22.042.1.4-5ubuntu1vulnerable
Ubunturuby-rack22.042.1.4-5ubuntu1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-racksourcesid2.2.4-3not yet assignedNot reported[1029832]
Debianruby-racksourceforky2.2.4-3not yet assignedNot reported[1029832]
Debianruby-racksourcetrixie2.2.4-3not yet assignedNot reported[1029832]
Debianruby-racksourcebookworm2.2.4-3not yet assignedNot reported[1029832]
Ubunturuby-rackdebpro2.1.4-5ubuntu1+esm3Not reportedUBUNTU-CVE-2022-44572Not reported
Ubunturuby-rackdeb22.042.1.4-5ubuntu1.1Not reportedUBUNTU-CVE-2022-44572Not reported

[Debian bug #1029832]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [ruby-rack]Unknown
    Details (4)

    • 2.2.22-0+deb12u1 · all · bookworm

      Fixed · Fixed: 2.2.4-3

      dsa · ruby-rack · debian · bookworm

    • 2.2.22-0+deb12u1 · all · bookworm

      Fixed · Fixed: 2.2.4-3

      dsa · ruby-rack · debian · bookworm

    • 2.2.22-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 2.2.4-3

      dsa · ruby-rack · debian · bookworm

    • 2.2.22-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 2.2.4-3

      dsa · ruby-rack · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]