CVE-2023-27530

State: Published
Severity: 7.5 High
Published: Mar 10, 2023
Updated: Oct 15, 2024
Reserved: Mar 2, 2023

Description

A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-400 Denial of Service (CWE-400)
CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
https://github.com/rack/rackn/a	3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3Affected

References

https://discuss.rubyonrails.org/t/cve-2023-27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388
[debian-lts-announce] 20230417 [SECURITY] [DLA 3392-1] ruby-rack security updatemailing-list
DSA-5530vendor-advisory
https://security.netapp.com/advisory/ntap-20231208-0015/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.