CVE-2012-6109
Rack vulnerable to REDoS
CVE-2012-6109 is a medium vulnerability (CVSS 4.3) in Rack Project Rack, published March 1, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.72%, the 86th percentile. Fixed in rack 1.1.4.
lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.
Exploit likelihood
What each source reports
NVD Score used
lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.
- Record
CVE-2012-6109- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.
- Record
CVE-2012-6109- Updated
- 2026-11-02
EUVDEUVD-2017-0248 No score
lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.
- Record
EUVD-2017-0248- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h77x-m5q8-c29h No score
Rack vulnerable to REDoS
lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.
- Record
GHSA-h77x-m5q8-c29h- Weakness
- CWE-835
- Updated
- 2026-11-02
OSV No score
lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.
- Record
CVE-2012-6109- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-6109 No score
lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.
- Record
DEBIAN-CVE-2012-6109- Updated
- 2026-11-02
OSVGHSA-h77x-m5q8-c29h No score
Rack vulnerable to REDoS
lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.
- Record
GHSA-h77x-m5q8-c29h- Weakness
- CWE-835
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2012-6109 No score
lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.
- Record
UBUNTU-CVE-2012-6109- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rackRubyGems |
before 1.1.4 | 1.1.4 |
rackRubyGems |
1.2.0 up to 1.2.6 | 1.2.6 |
rackRubyGems |
1.3.0 up to 1.3.7 | 1.3.7 |
rackRubyGems |
1.4.0 up to 1.4.2 | 1.4.2 |
ruby-rackDebian:12 |
before 1.4.1-2.1 | 1.4.1-2.1 |
ruby-rackDebian:13 |
before 1.4.1-2.1 | 1.4.1-2.1 |
ruby-rackDebian:14 |
before 1.4.1-2.1 | 1.4.1-2.1 |
rackRubyGems |
before 1.1.4, plus listed versions 0.1.00.2.00.3.00.4.00.9.0 Show 8 moreShow less0.9.11.0.01.0.11.1.01.1.11.1.1.pre1.1.21.1.3 |
1.1.4 |
rackRubyGems |
1.2.0 up to 1.2.6, plus listed versions 1.2.11.2.21.2.31.2.41.2.5 |
1.2.6 |
rackRubyGems |
1.3.0 up to 1.3.7, plus listed versions 1.3.11.3.21.3.31.3.41.3.51.3.6 |
1.3.7 |
rackRubyGems |
1.4.0 up to 1.4.2, plus listed versions 1.4.1 |
1.4.2 |
ruby-rackUbuntu:14.04:LTS |
before 1.5.2-1 | 1.5.2-1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugzilla.redhat.com/show_bug.cgi?id=895277
github.com/rack/rack/commit/c9f65df37a151821eb88ddd1dc404b83e52c52d5
rack.github.com
groups.google.com/forum
rhn.redhat.com/errata/RHSA-2013-0548.html
Show 10 moreShow less
nvd.nist.gov/vuln/detail/CVE-2012-6109
access.redhat.com/errata/RHSA-2013:0544
security-tracker.debian.org/tracker/CVE-2012-6109
ubuntu.com/security/CVE-2012-6109
cve.org/CVERecord?id=CVE-2012-6109