CVE catalog

CVE-2023-27530

Rack vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.83% · Oct 27, 2026

A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-racksid3.2.7-1fixed
Debianruby-rackforky3.2.7-1fixed
Debianruby-racktrixie3.1.20-0+deb13u1fixed
Debianruby-racktrixie-security3.1.20-0+deb13u2fixed
Debianruby-rackbookworm2.2.22-0+deb12u1fixed
Debianruby-rackbookworm-security2.2.22-0+deb12u2fixed
Ubunturuby-racknoble2.2.7-1ubuntu0.1fixed
Ubunturuby-rackpro2.1.4-3vulnerable
Ubunturuby-rackpro2.1.4-4vulnerable
Ubunturuby-rackpro2.1.4-5vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm2vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm3vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm4fixed
Ubunturuby-rackpro2.1.4-3vulnerable
Ubunturuby-rackpro2.1.4-4vulnerable
Ubunturuby-rackpro2.1.4-5vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm2vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm3vulnerable
Ubunturuby-rackpro2.1.4-5ubuntu1+esm4fixed
Ubunturuby-rack22.042.1.4-3vulnerable
Ubunturuby-rack22.042.1.4-4vulnerable
Ubunturuby-rack22.042.1.4-5vulnerable
Ubunturuby-rack22.042.1.4-5ubuntu1vulnerable
Ubunturuby-rack22.042.1.4-5ubuntu1.1fixed
Ubunturuby-rack24.042.2.4-3vulnerable
Ubunturuby-rack24.042.2.7-1vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.1fixed
Susermt-serverlinux enterprise module for public cloud 15 sp12.13-150100.3.45.1fixed
Susermt-serverlinux enterprise high performance computing 15 sp1-ltss2.13-150100.3.45.1fixed
Susermt-serverlinux enterprise server 15 sp1-ltss2.13-150100.3.45.1fixed
Susermt-serverlinux enterprise server for sap applications 15 sp12.13-150100.3.45.1fixed
Opensuserubygem-racktumbleweed2.2.6.3-1.1fixed
Susermt-serverlinux enterprise module for public cloud 15 sp32.13-150300.3.24.1fixed
Susermt-serverlinux enterprise high performance computing 15 sp3-espos2.13-150300.3.24.1fixed
Susermt-serverlinux enterprise high performance computing 15 sp3-ltss2.13-150300.3.24.1fixed
Susermt-serverlinux enterprise real time 15 sp32.13-150300.3.24.1fixed
Susermt-serverlinux enterprise server 15 sp3-ltss2.13-150300.3.24.1fixed
Susermt-serverlinux enterprise server for sap applications 15 sp32.13-150300.3.24.1fixed
Susermt-servermanager proxy 4.22.13-150300.3.24.1fixed
Susermt-servermanager server 4.22.13-150300.3.24.1fixed
Susermt-serverenterprise storage 7.12.13-150300.3.24.1fixed
Susermt-serverlinux enterprise module for public cloud 15 sp42.13-150400.3.12.1fixed
Susermt-serverlinux enterprise module for server applications 15 sp42.13-150400.3.12.1fixed
Opensusermt-serverleap 15.42.13-150400.3.12.1fixed
Opensuserubygem-racktumbleweed3.0.4.2-1.1fixed
Susermt-serverlinux enterprise module for public cloud 15 sp22.13-150200.3.32.1fixed
Susermt-serverlinux enterprise high performance computing 15 sp2-ltss2.13-150200.3.32.1fixed
Susermt-serverlinux enterprise server 15 sp2-ltss2.13-150200.3.32.1fixed
Susermt-serverlinux enterprise server for sap applications 15 sp22.13-150200.3.32.1fixed
Susermt-serverenterprise storage 72.13-150200.3.32.1fixed
Suserubygem-racklinux enterprise high availability extension 15 sp12.0.8-150000.3.15.1fixed
Suserubygem-racklinux enterprise high availability extension 15 sp22.0.8-150000.3.15.1fixed
Suserubygem-racklinux enterprise high availability extension 15 sp32.0.8-150000.3.15.1fixed
Suserubygem-racklinux enterprise high availability extension 15 sp42.0.8-150000.3.15.1fixed
Opensuserubygem-rackleap 15.42.0.8-150000.3.15.1fixed
CperackNot reported3.0.4.2fixed
Cpedebian_linuxNot reportedNot reportedunknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-racksourcesid2.2.6.4-1not yet assignedNot reported[1032803]
Debianruby-racksourceforky2.2.6.4-1not yet assignedNot reported[1032803]
Debianruby-racksourcetrixie2.2.6.4-1not yet assignedNot reported[1032803]
Debianruby-racksourcebookworm2.2.6.4-1not yet assignedNot reported[1032803]
Ubunturuby-rackdebnoble2.2.7-1ubuntu0.1Not reportedNot reportedNot reported
Ubunturuby-rackdebpro2.1.4-5ubuntu1+esm4Not reportedUSN-6905-1Not reported
Ubunturuby-rackdebpro2.1.4-5ubuntu1+esm4Not reportedUBUNTU-CVE-2023-27530Not reported
Ubunturuby-rackdeb22.042.1.4-5ubuntu1.1Not reportedUBUNTU-CVE-2023-27530Not reported
Ubunturuby-rackdeb24.042.2.7-1ubuntu0.1Not reportedUSN-6837-1Not reported
Susermt-serverrpmlinux enterprise module for public cloud 15 sp12.13-150100.3.45.1Not reportedSUSE-SU-2023:2304-1Not reported
Susermt-serverrpmlinux enterprise high performance computing 15 sp1-ltss2.13-150100.3.45.1Not reportedSUSE-SU-2023:2304-1Not reported
Susermt-serverrpmlinux enterprise server 15 sp1-ltss2.13-150100.3.45.1Not reportedSUSE-SU-2023:2304-1Not reported
Susermt-serverrpmlinux enterprise server for sap applications 15 sp12.13-150100.3.45.1Not reportedSUSE-SU-2023:2304-1Not reported
Opensuserubygem-rackrpmtumbleweed2.2.6.3-1.1Not reportedOPENSUSE-SU-2024:12784-1Not reported
Susermt-serverrpmlinux enterprise module for public cloud 15 sp32.13-150300.3.24.1Not reportedSUSE-SU-2023:2280-1Not reported
Susermt-serverrpmlinux enterprise high performance computing 15 sp3-espos2.13-150300.3.24.1Not reportedSUSE-SU-2023:2280-1Not reported
Susermt-serverrpmlinux enterprise high performance computing 15 sp3-ltss2.13-150300.3.24.1Not reportedSUSE-SU-2023:2280-1Not reported
Susermt-serverrpmlinux enterprise real time 15 sp32.13-150300.3.24.1Not reportedSUSE-SU-2023:2280-1Not reported
Susermt-serverrpmlinux enterprise server 15 sp3-ltss2.13-150300.3.24.1Not reportedSUSE-SU-2023:2280-1Not reported
Susermt-serverrpmlinux enterprise server for sap applications 15 sp32.13-150300.3.24.1Not reportedSUSE-SU-2023:2280-1Not reported
Susermt-serverrpmmanager proxy 4.22.13-150300.3.24.1Not reportedSUSE-SU-2023:2280-1Not reported
Susermt-serverrpmmanager server 4.22.13-150300.3.24.1Not reportedSUSE-SU-2023:2280-1Not reported
Susermt-serverrpmenterprise storage 7.12.13-150300.3.24.1Not reportedSUSE-SU-2023:2280-1Not reported
Susermt-serverrpmlinux enterprise module for public cloud 15 sp42.13-150400.3.12.1Not reportedSUSE-SU-2023:2295-1Not reported
Susermt-serverrpmlinux enterprise module for server applications 15 sp42.13-150400.3.12.1Not reportedSUSE-SU-2023:2295-1Not reported
Opensusermt-serverrpmleap 15.42.13-150400.3.12.1Not reportedSUSE-SU-2023:2295-1Not reported
Opensuserubygem-rackrpmtumbleweed3.0.4.2-1.1Not reportedOPENSUSE-SU-2024:12773-1Not reported
Susermt-serverrpmlinux enterprise module for public cloud 15 sp22.13-150200.3.32.1Not reportedSUSE-SU-2023:2294-1Not reported
Susermt-serverrpmlinux enterprise high performance computing 15 sp2-ltss2.13-150200.3.32.1Not reportedSUSE-SU-2023:2294-1Not reported
Susermt-serverrpmlinux enterprise server 15 sp2-ltss2.13-150200.3.32.1Not reportedSUSE-SU-2023:2294-1Not reported
Susermt-serverrpmlinux enterprise server for sap applications 15 sp22.13-150200.3.32.1Not reportedSUSE-SU-2023:2294-1Not reported
Susermt-serverrpmenterprise storage 72.13-150200.3.32.1Not reportedSUSE-SU-2023:2294-1Not reported
Suserubygem-rackrpmlinux enterprise high availability extension 15 sp12.0.8-150000.3.15.1Not reportedSUSE-SU-2023:0725-1Not reported
Suserubygem-rackrpmlinux enterprise high availability extension 15 sp22.0.8-150000.3.15.1Not reportedSUSE-SU-2023:0725-1Not reported
Suserubygem-rackrpmlinux enterprise high availability extension 15 sp32.0.8-150000.3.15.1Not reportedSUSE-SU-2023:0725-1Not reported
Suserubygem-rackrpmlinux enterprise high availability extension 15 sp42.0.8-150000.3.15.1Not reportedSUSE-SU-2023:0725-1Not reported
Opensuserubygem-rackrpmleap 15.42.0.8-150000.3.15.1Not reportedSUSE-SU-2023:0725-1Not reported
CperackcpeNot reported3.0.4.2Not reportedNVD-CVE-2023-27530Not reported

[Debian bug #1032803]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [ruby4.0-rubygem-rack]Unknown

    Source package: [rubygem-rack]

    Details (1)

    • 3.2.7-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.2.6.3-1.1, 3.0.4.2-1.1

      Version impact unknown

      usn · rubygem-rack · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [ruby-rack]Fixed
    Details (4)

    • 2.2.22-0+deb12u1 · all · bookworm

      Fixed · Fixed: 2.2.6.4-1

      usn · ruby-rack · debian · bookworm; usn · ruby-rack · debian · 12

    • 2.2.22-0+deb12u1 · all · bookworm

      Fixed · Fixed: 2.2.6.4-1

      usn · ruby-rack · debian · bookworm; usn · ruby-rack · debian · 12

    • 2.2.22-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 2.2.6.4-1

      usn · ruby-rack · debian · bookworm; usn · ruby-rack · debian · 12

    • 2.2.22-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 2.2.6.4-1

      usn · ruby-rack · debian · bookworm; usn · ruby-rack · debian · 12

[Debian 13 (Trixie)]

  • [ruby-rack]Fixed
    Details (5)

    • 3.1.20-0+deb13u1 · all · trixie

      Fixed · Fixed: 2.2.6.4-1

      usn · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie

      Fixed · Fixed: 2.2.6.4-1

      usn · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.2.6.4-1

      usn · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 2.2.6.4-1

      usn · ruby-rack · debian · 13

    • 3.1.20-0+deb13u2 · all · trixie-security

      Fixed · Fixed: 2.2.6.4-1

      usn · ruby-rack · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]