CVE-2025-49007
published 2025-06-04CVE-2025-49007: Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the…
PriorityP426medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
0.48%
38.9th percentile
Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571. Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. Version 3.1.16 contains a patch for the vulnerability.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ruby-rack | < ruby-rack 3.1.16-0.1 (forky) | ruby-rack 3.1.16-0.1 (forky) |
| rack | rack | >= 3.1.0 < 3.1.16 | 3.1.16 |
| rack | rack | >= 3.1.0 < 3.1.16 | 3.1.16 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv4.06.6MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa7.5HIGH
osv7.5HIGH
vendor_debian7.5LOW
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
ReDoS Vulnerability in Rack::Multipart handle_mime_head
ghsa·2025-06-05·CVSS 7.5
CVE-2025-49007 [HIGH] CWE-770 ReDoS Vulnerability in Rack::Multipart handle_mime_head
ReDoS Vulnerability in Rack::Multipart handle_mime_head
### Summary
There is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571.
### Details
Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
### Credits
Thanks to [scyoon](https://hackerone.com/scyoon) for reporting this to the Rails security team
OSV
ReDoS Vulnerability in Rack::Multipart handle_mime_head
osv·2025-06-05·CVSS 7.5
CVE-2025-49007 [HIGH] ReDoS Vulnerability in Rack::Multipart handle_mime_head
ReDoS Vulnerability in Rack::Multipart handle_mime_head
### Summary
There is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571.
### Details
Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
### Credits
Thanks to [scyoon](https://hackerone.com/scyoon) for reporting this to the Rails security team
OSV
CVE-2025-49007: Rack is a modular Ruby web server interface
osv·2025-06-04·CVSS 7.5
CVE-2025-49007 [HIGH] CVE-2025-49007: Rack is a modular Ruby web server interface
Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571. Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. Version 3.1.16 contains a patch for the vulnerability.
Red Hat
rack: rubygem-rack: Rack Content-Disposition Denial of Service
vendor_redhat·2025-06-04·CVSS 7.5
CVE-2025-49007 [HIGH] CWE-770 rack: rubygem-rack: Rack Content-Disposition Denial of Service
rack: rubygem-rack: Rack Content-Disposition Denial of Service
Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571. Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. Version 3.1.16 contains a patch for the vulnerability.
A flaw was found in Rack. The Content-Disposition parsing component exhibits a den
Debian
CVE-2025-49007: ruby-rack - Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior...
vendor_debian·2025·CVSS 7.5
CVE-2025-49007 [HIGH] CVE-2025-49007: ruby-rack - Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior...
Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571. Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. Version 3.1.16 contains a patch for the vulnerability.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 3.1.16-0.1)
sid: resolved (fixed in 3.1.16-0.1)
trixie: resolved (fixe
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-06-04
Published