CVE-2023-27539
published 2025-01-09CVE-2023-27539: There is a denial of service vulnerability in the header parsing component of Rack.
PriorityP424medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
1.08%
61.7th percentile
There is a denial of service vulnerability in the header parsing component of Rack.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | ruby-rack | < ruby-rack 2.2.6.4-1 (bookworm) | ruby-rack 2.2.6.4-1 (bookworm) |
| rack | rack | >= 2.0.0 < 2.2.6.4 | 2.2.6.4 |
| rack | rack | >= 2.0.0 < 2.2.6.4 | 2.2.6.4 |
| rack | rack | >= 3.0.0 < 3.0.6.1 | 3.0.6.1 |
| rack | rack | >= 3.0.0 < 3.0.6.1 | 3.0.6.1 |
| rails | rack | >= 2.2.6.4 < 2.2.6.4 | 2.2.6.4 |
| rails | rack | >= 3.0.6.1 < 3.0.6.1 | 3.0.6.1 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
ghsa5.3MEDIUM
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-27539: There is a denial of service vulnerability in the header parsing component of Rack
osv·2025-01-09·CVSS 5.3
CVE-2023-27539 [MEDIUM] CVE-2023-27539: There is a denial of service vulnerability in the header parsing component of Rack
There is a denial of service vulnerability in the header parsing component of Rack.
OSV
ruby-rack vulnerabilities
osv·2024-09-26·CVSS 7.5
CVE-2022-30122 [HIGH] ruby-rack vulnerabilities
ruby-rack vulnerabilities
It was discovered that Rack was not properly parsing data when processing
multipart POST requests. If a user or automated system were tricked into
sending a specially crafted multipart POST request to an application using
Rack, a remote attacker could possibly use this issue to cause a denial of
service. (CVE-2022-30122)
It was discovered that Rack was not properly escaping untrusted data when
performing logging operations, which could cause shell escaped sequences
to be written to a terminal. If a user or automated system were tricked
into sending a specially crafted request to an application using Rack, a
remote attacker could possibly use this issue to execute arbitrary code in
the machine running the application. (CVE-2022-30123)
It was discovered that Rack
OSV
ruby-rack vulnerabilities
osv·2024-07-23·CVSS 7.5
CVE-2023-27539 [HIGH] ruby-rack vulnerabilities
ruby-rack vulnerabilities
It was discovered that Rack incorrectly handled certain regular
expressions. A remote attacker could possibly use this issue to cause
Rack to consume resources, leading to a denial of service.
(CVE-2023-27539)
It was discovered that Rack incorrectly handled Multipart MIME parsing.
A remote attacker could possibly use this issue to cause Rack to consume
resources, leading to a denial of service. This issue only affected
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-27530)
OSV
ruby-rack vulnerabilities
osv·2024-03-12·CVSS 5.3
CVE-2023-27539 [MEDIUM] ruby-rack vulnerabilities
ruby-rack vulnerabilities
It was discovered that Rack incorrectly parse some headers.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2023-27539, CVE-2024-26141, CVE-2024-26146)
OSV
Possible Denial of Service Vulnerability in Rack's header parsing
osv·2023-03-15·CVSS 5.3
CVE-2023-27539 [MEDIUM] Possible Denial of Service Vulnerability in Rack's header parsing
Possible Denial of Service Vulnerability in Rack's header parsing
There is a denial of service vulnerability in the header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27539.
Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.2.6.4, 3.0.6.1
# Impact
Carefully crafted input can cause header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse headers using Rack (virtually all Rails applications) are impacted.
# Workarounds
Setting Regexp.timeout in Ruby 3.2 is a possible workaround.
GHSA
Possible Denial of Service Vulnerability in Rack's header parsing
ghsa·2023-03-15·CVSS 5.3
CVE-2023-27539 [MEDIUM] Possible Denial of Service Vulnerability in Rack's header parsing
Possible Denial of Service Vulnerability in Rack's header parsing
There is a denial of service vulnerability in the header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27539.
Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.2.6.4, 3.0.6.1
# Impact
Carefully crafted input can cause header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse headers using Rack (virtually all Rails applications) are impacted.
# Workarounds
Setting Regexp.timeout in Ruby 3.2 is a possible workaround.
Ubuntu
Rack vulnerabilities
vendor_ubuntu·2024-09-26·CVSS 7.5
CVE-2024-25126 [HIGH] Rack vulnerabilities
Title: Rack vulnerabilities
Summary: Several security issues were fixed in Rack.
It was discovered that Rack was not properly parsing data when processing
multipart POST requests. If a user or automated system were tricked into
sending a specially crafted multipart POST request to an application using
Rack, a remote attacker could possibly use this issue to cause a denial of
service. (CVE-2022-30122)
It was discovered that Rack was not properly escaping untrusted data when
performing logging operations, which could cause shell escaped sequences
to be written to a terminal. If a user or automated system were tricked
into sending a specially crafted request to an application using Rack, a
remote attacker could possibly use this issue to execute arbitrary code in
the machine running the ap
Ubuntu
Rack vulnerabilities
vendor_ubuntu·2024-07-23·CVSS 7.5
CVE-2023-27530 [HIGH] Rack vulnerabilities
Title: Rack vulnerabilities
Summary: Rack could be made to consume resources and cause long delays if it
processed certain input.
It was discovered that Rack incorrectly handled certain regular
expressions. A remote attacker could possibly use this issue to cause
Rack to consume resources, leading to a denial of service.
(CVE-2023-27539)
It was discovered that Rack incorrectly handled Multipart MIME parsing.
A remote attacker could possibly use this issue to cause Rack to consume
resources, leading to a denial of service. This issue only affected
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-27530)
Instructions: After a standard system update you need to restart any applications using
Rack to make all the necessary changes.
Ubuntu
Rack vulnerabilities
vendor_ubuntu·2024-03-12·CVSS 5.3
CVE-2024-26146 [MEDIUM] Rack vulnerabilities
Title: Rack vulnerabilities
Summary: Rack could be made do denial of service if it received a specially
crafted header.
It was discovered that Rack incorrectly parse some headers.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2023-27539, CVE-2024-26141, CVE-2024-26146)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
rubygem-rack: denial of service in header parsing
vendor_redhat·2023-03-15·CVSS 5.3
CVE-2023-27539 [MEDIUM] CWE-1333 rubygem-rack: denial of service in header parsing
rubygem-rack: denial of service in header parsing
There is a denial of service vulnerability in the header parsing component of Rack.
A denial of service vulnerability was found in rubygem-rack in how it parses headers. A carefully crafted input can cause header parsing to take an unexpected amount of time, possibly resulting in a denial of service.
Mitigation: Setting Regexp.timeout in Ruby 3.2 is a possible workaround.
Package: 3scale-amp-backend-container (Red Hat 3scale API Management Platform 2) - Affected
Package: 3scale-amp-zync-container (Red Hat 3scale API Management Platform 2) - Will not fix
Package: pcs (Red Hat Enterprise Linux 7) - Not affected
Package: rubygem-rack (Red Hat Storage 3) - Will not fix
Debian
CVE-2023-27539: ruby-rack - There is a denial of service vulnerability in the header parsing component of Ra...
vendor_debian·2023·CVSS 5.3
CVE-2023-27539 [MEDIUM] CVE-2023-27539: ruby-rack - There is a denial of service vulnerability in the header parsing component of Ra...
There is a denial of service vulnerability in the header parsing component of Rack.
Scope: local
bookworm: resolved (fixed in 2.2.6.4-1)
bullseye: resolved (fixed in 2.1.4-3+deb11u1)
forky: resolved (fixed in 2.2.6.4-1)
sid: resolved (fixed in 2.2.6.4-1)
trixie: resolved (fixed in 2.2.6.4-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://discuss.rubyonrails.org/t/cve-2023-27539-possible-denial-of-service-vulnerability-in-racks-header-parsing/82466https://github.com/advisories/GHSA-c6qg-cjj8-47qphttps://github.com/rack/rack/commit/231ef369ad0b542575fb36c74fcfcfabcf6c530chttps://github.com/rack/rack/commit/ee7919ea04303717858be1c3f16b406adc6d8cffhttps://lists.debian.org/debian-lts-announce/2023/04/msg00017.htmlhttps://security.netapp.com/advisory/ntap-20231208-0016/https://www.debian.org/security/2023/dsa-5530
2025-01-09
Published