Overview
Rack is a modular Ruby web server interface.
A Regular expression Denial of Service (ReDoS) vulnerability (CVE-2025-49007) has been identified in Rack, which allows attackers to monopolize resources when parsing the Content-Disposition header, effectively causing a denial of service of the application. This is very similar to the previous security issue CVE-2022-44571.
Per OWASP: The Regular expression Denial of Service (ReDoS) is a Denial of Service attack that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression (Regex) to enter these extreme situations and then hang for a very long time.
This affects Rack versions greater than or equal to 3.1.0 and less than 3.1.16.
Details
Module Info
- Product: Rack
- Affected packages: rack
- Affected versions: >=3.1.0 <3.1.16
- Github repository: https://github.com/rack/rack
- Published packages: https://rubygems.org/gems/rack
- Package manager: RubyGems
- Fixed in: OSS Rack v3.1.16 and Rails NES Rack v1.4.7.24, v1.6.13.22 and v2.2.17.10
Vulnerability Info
This Medium-severity vulnerability is found in the rack module in versions greater than or equal to 3.1.0 and less than 3.1.16.
A carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
Mitigation
OSS Users
Upgrade to Rack version 3.1.16 where the issue is fixed. If an upgrade is not possible, consider using a commercial support partner like HeroDevs for post EOL support.
NES Customers
Upgrade to Rack versions 1.4.7.24, 1.6.13.22 or 2.2.17.10 where the issue is fixed.
For customers making use of Rails v5 or v6 - you will also need to update your version of Rails to 5.2.8.32 or 6.1.7.28 respectively to accommodate the Rack version bump.
Credits
scyoon (finder)
