CVE-2022-30122 — Uncontrolled Resource Consumption in Project Rack

CWE-400 — Uncontrolled Resource ConsumptionCWE-1333 — Regex Denial of ServiceCWE-770 — Allocation of Resources Without Limits or Throttling14 documents8 sources
Severity
7.5HIGHNVD
OSV5.9
EPSS
1.0%
top 23.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Rack Project RackRackHttps Github.com Rack Rack+1 more
Timeline
PublishedDec 5
Latest updateSep 26

Description

A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶RubyGemsrack/rack1.2 — 2.0.9.1+2
▶NVDrack_project/rack1.2 — 2.0.9.1+2
▶CVEListV5https/github.com_rack_rack2.0.9.1, 2.1.4.1, 2.2.3.1

Also affects: Debian Linux 11.0

🔴Vulnerability Details

7
OSV
ruby-rack vulnerabilities↗2024-09-26
▶
OSV
ruby-rack vulnerabilities↗2023-02-27
▶
OSV
ruby-rack vulnerabilities↗2022-12-13
▶
OSV
CVE-2022-30122: A possible denial of service vulnerability exists in Rack <2↗2022-12-05
▶
CVEList
CVE-2022-30122: A possible denial of service vulnerability exists in Rack <2↗2022-12-05
▶

📋Vendor Advisories

5
Ubuntu
Rack vulnerabilities↗2024-09-26
▶
Ubuntu
Rack vulnerabilities↗2023-02-27
▶
Ubuntu
Rack vulnerabilities↗2022-12-13
▶
Red Hat
rubygem-rack: crafted multipart POST request may cause a DoS↗2022-05-27
▶
Debian
CVE-2022-30122: ruby-rack - A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and...↗2022
▶

💬Community

1
HackerOne
Rack CVE-2022-30122: Denial of Service Vulnerability in Rack Multipart Parsing↗2022-07-23
▶
CVE-2022-30122 — Uncontrolled Resource Consumption | cvebase