~ / search / GHSA-47m2-26rw-j2jw

GHSA-47m2-26rw-j2jw

ReDoS Vulnerability in Rack::Multipart handle_mime_head

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-49007

Packages

EcosystemPackageAffectedFixed in
RubyGems rack >= 3.1.0, < 3.1.16 3.1.16

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary There is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571. ### Details Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. ### Credits Thanks to [scyoon](https://hackerone.com/scyoon) for reporting this to the Rails security team

References

External links from the advisory. They lead to third-party sites.