{"id":"CVE-2022-44572","aliases":["DEBIAN-CVE-2022-44572","DLA-3298-1","DSA-5530-1","EUVD-2023-0547","GHSA-rqv2-275x-2jq5","MGASA-2023-0106","OESA-2024-1820","OESA-2024-1821","OESA-2024-1822","OESA-2024-1823","RHSA-2023:6818","RLSA-2023:6818","SUSE-SU-2023:0276-1","UBUNTU-CVE-2022-44572","USN-5910-1","USN-7036-1","openSUSE-SU-2024:12633-1","openSUSE-SU-2024:12634-1","openSUSE-SU-2024:12974-1","openSUSE-SU-2024:13167-1","openSUSE-SU-2024:13726-1","openSUSE-SU-2024:13727-1","openSUSE-SU-2025:14811-1","openSUSE-SU-2025:14875-1","openSUSE-SU-2026:10286-1","openSUSE-SU-2026:10358-1"],"status":"published","title":"Denial of service via multipart parsing in Rack","description":"A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01617,"percentile":0.76192,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333","CWE-400"],"published":"2023-01-18T18:19:21Z","modified":"2026-11-03T06:03:00Z","fixes":[{"ecosystem":"RubyGems","package":"rack","fixed_in":["2.0.9.2","2.1.4.2","2.2.6.1","3.0.4.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-rack","fixed_in":["2.2.4-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-rack","fixed_in":["2.2.4-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-rack","fixed_in":["2.2.4-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-rack","fixed_in":["2.0.7-2ubuntu0.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"ruby-rack","fixed_in":["2.1.4-5ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-rack","fixed_in":["2.1.4-5ubuntu1+esm3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.9.2"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0.0"},{"fixed":"2.1.4.2"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0.0"},{"fixed":"2.2.6.1"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0.0"},{"fixed":"3.0.4.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-3"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.6-3+deb10u2"}]}],"versions":["2.0.6-3","2.0.6-3+deb10u1"],"bundled":5},{"source":"osv","ecosystem":"Debian:11","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-3+deb11u1"}]}],"versions":["2.1.4-3"],"bundled":7},{"source":"osv","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.9.2"}]}],"versions":["2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.0.9.1"]},{"source":"osv","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0.0"},{"fixed":"2.1.4.2"}]}],"versions":["2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.4.1"]},{"source":"osv","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0.0"},{"fixed":"2.2.6.1"}]}],"versions":["2.2.0","2.2.1","2.2.2","2.2.3","2.2.3.1","2.2.4","2.2.5","2.2.6"]},{"source":"osv","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0.0"},{"fixed":"3.0.4.1"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4"]},{"source":"osv","ecosystem":"Mageia:8","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.1-1.2.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.1-4.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.1-5.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.1-4.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3.1-5.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-kubeclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.1-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.26.0-3.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"puppet-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.26.0-3.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-pulp-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.16.0-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-pulp-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.16.0-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-pulp-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.16.0-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-pulp-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.16.0-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.9-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.9-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.14::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.9-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.14::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.9-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.9-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.9-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.9-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.9-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.9-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.9-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.9-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.9-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.9-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.9-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.9-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.9-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.9-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0.9-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-future","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.18.3-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-future","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.18.3-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-future","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.18.3-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-future","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.18.3-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.3-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.7-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.7-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.0-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"puppetserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.11.0-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"puppetserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.11.0-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.3-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.3-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"rubygem-globalid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-1.el8sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.4-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.4-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.4-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.4-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.21-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.21-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.21-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.21-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.31.0-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.31.0-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.31.0-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.31.0-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.32-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.14::el8","package":"python39-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.32-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.32-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.14::el8","package":"python39-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.32-1.el8pc"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-150000.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-150000.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-150000.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-150000.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-150000.3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-2ubuntu0.1+esm3"}]}],"versions":["2.0.6-3","2.0.7-2","2.0.7-2ubuntu0.1","2.0.7-2ubuntu0.1+esm1","2.0.7-2ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-5ubuntu1.1"}]}],"versions":["2.1.4-3","2.1.4-4","2.1.4-5","2.1.4-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-5ubuntu1+esm3"}]}],"versions":["2.1.4-3","2.1.4-4","2.1.4-5","2.1.4-5ubuntu1","2.1.4-5ubuntu1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-3+deb8u3ubuntu1~esm6"}]}],"versions":["1.5.2-1","1.5.2-1ubuntu0.1~esm1","1.5.2-3+deb8u3ubuntu1~esm2","1.5.2-3+deb8u3ubuntu1~esm3","1.5.2-3+deb8u3ubuntu1~esm4"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-3ubuntu0.2+esm4"}]}],"versions":["1.5.2-4","1.6.4-2","1.6.4-3","1.6.4-3ubuntu0.1","1.6.4-3ubuntu0.2","1.6.4-3ubuntu0.2+esm1","1.6.4-3ubuntu0.2+esm2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-4ubuntu0.2+esm4"}]}],"versions":["1.6.4-4","1.6.4-4ubuntu0.1","1.6.4-4ubuntu0.2","1.6.4-4ubuntu0.2+esm1","1.6.4-4ubuntu0.2+esm2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-2ubuntu0.1+esm3"}]}],"versions":["2.0.6-3","2.0.7-2","2.0.7-2ubuntu0.1","2.0.7-2ubuntu0.1+esm1","2.0.7-2ubuntu0.1+esm2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-5ubuntu1+esm3"}]}],"versions":["2.1.4-3","2.1.4-4","2.1.4-5","2.1.4-5ubuntu1","2.1.4-5ubuntu1+esm2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.4-5ubuntu1.1"}]}],"versions":["2.1.4-3","2.1.4-4","2.1.4-5","2.1.4-5ubuntu1"],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4.1-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.6.2-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-1.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.7-1.2"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.1-1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8.1-1.1"}]}],"bundled":16},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-1.1"}]}],"bundled":17},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.12-1.1"}]}],"bundled":18},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack-2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.22-1.1"}]}],"bundled":27},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.18-1.3"}]}],"bundled":18}],"products":[{"vendor":"rack","product":"rack"}],"references":[{"url":"https://hackerone.com/reports/1639882","tags":["x_transferred","Permissions Required","Third Party Advisory","web"]},{"url":"https://www.debian.org/security/2023/dsa-5530","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20231208-0014/","tags":["x_transferred","advisory"]},{"url":"https://github.com/rack/rack/releases/tag/v3.0.4.1","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2022-44572.yml","tags":["web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44572","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rqv2-275x-2jq5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/44xxx/CVE-2022-44572.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-44572","tags":["advisory"]},{"url":"https://github.com/rack/rack","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2023-0106.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31496","tags":["report"]},{"url":"https://www.debian.org/lts/security/2023/dla-3298","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2023-February/013629.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FJFU3ZHNAUDV7V7P7HFAAT4TJIHOMW5K/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5910-1","tags":["advisory"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2023-March/014032.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1820","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26141","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1821","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1822","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1823","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6818","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2023-003","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1265120","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1726504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1735722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1813953","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1859112","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1872414","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1885552","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1904201","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1922972","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1925532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1944710","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1947095","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1949960","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1950836","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1955046","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1967030","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1972308","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1980277","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1992283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1995783","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2000215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2002202","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2009069","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2013759","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2043089","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044537","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2055790","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2058404","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069324","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069666","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2073535","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077633","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2080386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081494","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081777","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2082001","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2088559","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2090620","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2094301","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2096942","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2097310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103424","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2105676","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106473","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2116369","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2117760","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2122872","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2123306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124658","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125366","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2127134","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2129432","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2130173","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2130871","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2131990","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2134436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135498","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2138172","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2140577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2140636","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143051","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143290","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2145254","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2152951","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2154917","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2156522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2158510","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2158526","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2158702","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2158780","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2159104","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2159105","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2159291","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2159672","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2159839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2161209","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2161274","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2161993","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164359","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164714","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164730","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164736","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164785","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164789","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164799","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164800","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2165107","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2165866","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2165906","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2166404","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2166435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2166466","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2166640","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167097","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167146","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167371","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168414","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2169322","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2169385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2169682","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2169847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170125","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170127","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170485","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170535","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170917","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2171180","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172355","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172564","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2173159","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2173199","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2173535","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2173671","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2173692","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2173757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2174367","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2174912","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2176214","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2176368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2176477","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2176870","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178133","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178176","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178645","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178734","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2178775","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179574","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179721","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179725","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180490","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180760","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180865","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180954","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2181226","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2181254","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2181602","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2182353","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2183172","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2183357","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184278","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2186713","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2186765","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2187599","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2187613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2187903","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2187967","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2188504","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2188721","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2192565","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2192583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2192841","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2193088","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2193451","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196076","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196085","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196540","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2196775","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2203093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2203183","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2207782","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2208161","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2208535","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2209037","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2209469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2209938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2210284","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2210297","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2211210","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2211394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2211437","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2211484","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2211502","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2211711","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2211966","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2212148","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2212523","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2212630","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2212740","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2212756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2212812","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2212996","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2213088","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2213128","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2213190","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2213246","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2213281","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2213486","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2213515","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2213579","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2213582","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2213768","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2213777","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2213804","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2214261","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2214272","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2214274","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2214290","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2214578","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2215081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2215093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2215238","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2215294","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2215426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2215954","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2215986","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2216194","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2216461","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2216564","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2216757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2216907","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2217942","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218625","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218878","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218930","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218932","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2219648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2220965","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2220969","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2220978","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2221291","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2221407","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2221621","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2221983","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222446","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222447","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222705","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222890","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222907","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2223048","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2223050","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2223618","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2223707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2223891","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2223996","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224031","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224113","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224334","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224494","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224498","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2225090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2225141","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2225333","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2225383","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2225402","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2225406","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2225409","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2226950","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2227028","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2227093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2227271","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2227338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2228287","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2229788","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2229897","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2230584","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2230934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2231363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2231474","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2232370","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2232775","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2234444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2235231","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236685","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2239115","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242803","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243296","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2245056","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2245930","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6818.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0759","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0759","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0759","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1292","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1292","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1292","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20220503.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2068","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2068","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20220621.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3644","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3644","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3644","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3874","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3874","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3874","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-4130","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-4130","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-4130","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40899","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40899","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40899","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41717","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41717","tags":["advisory"]},{"url":"https://go.dev/cl/455635","tags":["article"]},{"url":"https://go.dev/cl/455717","tags":["article"]},{"url":"https://go.dev/issue/56350","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2022-1144","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-44566","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-44566","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44566","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2022-44566.yml","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-44570","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-44570","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44570","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/tree/master/gems/rack/CVE-2022-44570.yml","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-44571","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-44571","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44571","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/tree/master/gems/rack/CVE-2022-44571.yml","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-44572","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-44572","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-46648","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-46648","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46648","tags":["advisory"]},{"url":"https://jvn.jp/en/jp/JVN16765254/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-47318","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-47318","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-47318","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0118","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0118","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0118","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0119","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-0119","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0119","tags":["advisory"]},{"url":"https://projects.theforeman.org/issues/35977","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-1894","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-1894","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1894","tags":["advisory"]},{"url":"https://www.puppet.com/security/cve/cve-2023-1894-puppet-server-redos","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-22792","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-22792","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22792","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-22792.yml","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-22794","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-22794","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22794","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2023-22794.yml","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-22795","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-22795","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22795","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-22795.yml","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-22796","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-22796","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22796","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j6gc-792m-qgm2","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-22799","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-22799","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22799","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-23c2-gwp5-pxw9","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27530","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27530","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27530","tags":["advisory"]},{"url":"https://discuss.rubyonrails.org/t/cve-2023-27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388","tags":["article"]},{"url":"https://github.com/rubysec/ruby-advisory-db/tree/master/gems/rack/CVE-2023-27530.yml","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27539","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27539","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27539","tags":["advisory"]},{"url":"https://discuss.rubyonrails.org/t/cve-2023-27539-possible-denial-of-service-vulnerability-in-racks-header-parsing/82466","tags":["article"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2023-27539.yml","tags":["article"]},{"url":"https://rubysec.com/advisories/CVE-2023-27539/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29406","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29406","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29406","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/2q13H6LEEx0","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-30608","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-30608","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30608","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-31047","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-31047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31047","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2023/may/03/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-32681","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32681","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32681","tags":["advisory"]},{"url":"https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-36053","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-36053","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36053","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2023/jul/03/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39325","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-44487","tags":["report"]},{"url":"https://go.dev/issue/63417","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2102","tags":["advisory"]},{"url":"https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40267","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40267","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40267","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-pr76-5cm5-w9cj","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-44487","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","tags":["advisory"]},{"url":"https://github.com/dotnet/announcements/issues/277","tags":["article"]},{"url":"https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2023:6818","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230276-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1207596","tags":["report"]},{"url":"https://bugzilla.suse.com/1207597","tags":["report"]},{"url":"https://bugzilla.suse.com/1207599","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44572","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-44572","tags":["report"]},{"url":"https://github.com/rack/rack/commit/dc50f8e495f67eb933b1fc33ebee550908d945e6","tags":["report"]},{"url":"https://github.com/rack/rack/commit/8291f502b0e1dcf514cc25c34e4bf0beec7a92ae","tags":["report"]},{"url":"https://github.com/rack/rack/commit/19e49f0f185d7e42ed5b402baec6c897a8c48029","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7036-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-44570","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-44571","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-30122","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-30123","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-27530","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-27539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-25126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26141","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-26146","tags":["report"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/ruby-rack/+bug/2078711","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-30123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-27539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26146","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FLQ74D2IZAJC5KD6QXVUZAQ6O5LNAWZX/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-25184","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MOZFATD6SCQREBY3SZW5KQJPN6KN7A6D/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25500","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-44572","description":"A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.","status":"published","published":"2023-02-09T00:00:00Z","modified":"2024-08-03T13:54:03.874Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:30.176321Z"}],"euvd":[{"id":"EUVD-2023-0547","description":"A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.","status":"published","published":"2023-02-09T00:00:00Z","modified":"2024-08-03T13:54:03Z","updated_at":"2026-11-03T03:25:19.130756Z"}],"ghsa":[{"id":"GHSA-rqv2-275x-2jq5","title":"Denial of service via multipart parsing in Rack","description":"There is a denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44572.\n\nVersions Affected: \u003e= 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.0.1\nImpact\n\nCarefully crafted input can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.\nReleases\n\nThe fixed releases are available at the normal locations.\nWorkarounds\n\nThere are no feasible workarounds for this issue.\nPatches\n\nTo aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.\n\n    2-0-Forbid-control-characters-in-attributes.patch - Patch for 2.0 series\n    2-1-Forbid-control-characters-in-attributes.patch - Patch for 2.1 series\n    2-2-Forbid-control-characters-in-attributes.patch - Patch for 2.2 series\n    3-0-Forbid-control-characters-in-attributes.patch - Patch for 3.0 series\n","status":"published","published":"2023-01-18T18:19:21Z","modified":"2023-10-23T19:17:24Z","cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-02T14:37:09.438703Z"}],"nvd":[{"id":"CVE-2022-44572","description":"A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.","status":"published","published":"2023-02-09T20:15:11.22Z","modified":"2026-06-17T05:08:32.737Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-02T14:07:36.026349Z"}],"osv":[{"id":"OESA-2024-1820","title":"rubygem-rack security update","description":"Rack provides a minimal, modular, and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers,  web frameworks, and software in between (the so-called middleware) into  a single method call.\r\n\r\nSecurity Fix(es):\r\n\r\nA denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.(CVE-2022-44572)\r\n\r\nRack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.(CVE-2024-26141)","status":"published","published":"2024-07-12T11:07:17Z","modified":"2026-08-18T01:18:29.198268417Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1821","title":"rubygem-rack security update","description":"Rack provides a minimal, modular, and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers,  web frameworks, and software in between (the so-called middleware) into  a single method call.\r\n\r\nSecurity Fix(es):\r\n\r\nA denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.(CVE-2022-44572)\r\n\r\nRack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.(CVE-2024-26141)","status":"published","published":"2024-07-12T11:07:17Z","modified":"2026-08-18T01:18:28.378223263Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1822","title":"rubygem-rack security update","description":"Rack provides a minimal, modular, and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers,  web frameworks, and software in between (the so-called middleware) into  a single method call.\r\n\r\nSecurity Fix(es):\r\n\r\nA denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.(CVE-2022-44572)\r\n\r\nRack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.(CVE-2024-26141)","status":"published","published":"2024-07-12T11:07:17Z","modified":"2026-08-18T01:18:28.380623437Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1823","title":"rubygem-rack security update","description":"Rack provides a minimal, modular, and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers,  web frameworks, and software in between (the so-called middleware) into  a single method call.\r\n\r\nSecurity Fix(es):\r\n\r\nA denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.(CVE-2022-44572)\r\n\r\nRack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the `Rack::File` middleware or the `Rack::Utils.byte_ranges` methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.(CVE-2024-26141)","status":"published","published":"2024-07-12T11:07:17Z","modified":"2026-08-18T01:18:29.285793723Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHSA-2023:6818","title":"Red Hat Security Advisory: Satellite 6.14 security and bug fix update","status":"published","published":"2024-10-02T11:32:05Z","modified":"2026-10-20T10:02:14Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"UBUNTU-CVE-2022-44572","description":"A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.","status":"published","published":"2023-02-09T20:15:00Z","modified":"2026-02-04T03:58:41.150086Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"CVE-2022-44572","description":"A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.","status":"published","published":"2023-02-09T00:00:00Z","modified":"2026-10-28T02:30:35.57606008Z","cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:27.481647Z"},{"id":"DEBIAN-CVE-2022-44572","description":"A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.","status":"published","published":"2023-02-09T20:15:11.22Z","modified":"2026-11-03T06:03:00.13642932Z","updated_at":"2026-11-03T06:43:01.507088Z"},{"id":"DLA-3298-1","title":"ruby-rack - security update","status":"published","published":"2023-01-31T00:00:00Z","modified":"2026-03-09T01:20:44.969645Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DSA-5530-1","title":"ruby-rack - security update","status":"published","published":"2023-10-22T00:00:00Z","modified":"2026-03-09T02:10:56.129859Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"GHSA-rqv2-275x-2jq5","title":"Denial of service via multipart parsing in Rack","description":"There is a denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44572.\n\nVersions Affected: \u003e= 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.0.1\nImpact\n\nCarefully crafted input can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.\nReleases\n\nThe fixed releases are available at the normal locations.\nWorkarounds\n\nThere are no feasible workarounds for this issue.\nPatches\n\nTo aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.\n\n    2-0-Forbid-control-characters-in-attributes.patch - Patch for 2.0 series\n    2-1-Forbid-control-characters-in-attributes.patch - Patch for 2.1 series\n    2-2-Forbid-control-characters-in-attributes.patch - Patch for 2.2 series\n    3-0-Forbid-control-characters-in-attributes.patch - Patch for 3.0 series\n","status":"published","published":"2023-01-18T18:19:21Z","modified":"2024-12-01T05:36:04.725362Z","cwes":["CWE-1333","CWE-400"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"MGASA-2023-0106","title":"Updated ruby-rack packages fix security vulnerability","description":"A denial of service vulnerability in the Range header parsing component of\nRack \u003e= 1.5.0. A Carefully crafted input can cause the Range header parsing\ncomponent in Rack to take an unexpected amount of time, possibly resulting\nin a denial of service attack vector. Any applications that deal with Range\nrequests (such as streaming applications, or applications that serve files)\nmay be impacted. (CVE-2022-44570)\n\nThere is a denial of service vulnerability in the Content-Disposition\nparsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This\ncould allow an attacker to craft an input that can cause Content-Disposition\nheader parsing in Rackto take an unexpected amount of time, possibly\nresulting in a denial ofservice attack vector. This header is used typically\nused in multipartparsing. Any applications that parse multipart posts using\nRack (virtuallyall Rails applications) are impacted. (CVE-2022-44571)\n\nA denial of service vulnerability in the multipart parsing component of Rack\nfixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker to\ncraft input that can cause RFC2183 multipart boundary parsing in Rack to\ntake an unexpected amount of time, possibly resulting in a denial of service\nattack vector. Any applications that parse multipart posts using Rack\n(virtually all Rails applications) are impacted. (CVE-2022-44572)\n\nA DoS vulnerability exists in Rack \u003cv3.0.4.2, \u003cv2.2.6.3, \u003cv2.1.4.3 and\n\u003cv2.0.9.3 within in the Multipart MIME parsing code in which could allow an\nattacker to craft requests that can be abuse to cause multipart parsing to\ntake longer than expected. (CVE-2023-27530)\n","status":"published","published":"2023-03-24T05:55:49Z","modified":"2026-04-16T04:43:16.384809824Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12633-1","title":"ruby3.1-rubygem-rack-3.0.4.1-1.1 on GA media","description":"These are all security issues fixed in the ruby3.1-rubygem-rack-3.0.4.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:35:33.701366Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:12634-1","title":"ruby3.1-rubygem-rack-2.2-2.2.6.2-1.1 on GA media","description":"These are all security issues fixed in the ruby3.1-rubygem-rack-2.2-2.2.6.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:30:32.722292Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"openSUSE-SU-2024:12974-1","title":"ruby3.2-rubygem-rack-2.2-2.2.7-1.1 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-rack-2.2-2.2.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:30:21.929927Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:13167-1","title":"ruby3.2-rubygem-rack-3.0.7-1.2 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-rack-3.0.7-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:42:45.897529Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:13726-1","title":"ruby3.3-rubygem-rack-3.0.9.1-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-rack-3.0.9.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:59.579529Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13727-1","title":"ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-rack-2.2-2.2.8.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:07:46.684926Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2025:14811-1","title":"ruby3.4-rubygem-rack-2.2-2.2.11-1.1 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-rack-2.2-2.2.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-02-14T00:00:00Z","modified":"2026-02-04T04:22:14.520853Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:14875-1","title":"ruby3.4-rubygem-rack-3.1.12-1.1 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-rack-3.1.12-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-03-11T00:00:00Z","modified":"2025-05-07T18:08:49.787747Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:10286-1","title":"ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-rack-2.2-2.2.22-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-04T00:00:00Z","modified":"2026-03-23T04:54:39.054152Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10358-1","title":"ruby4.0-rubygem-rack-3.1.18-1.3 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-rack-3.1.18-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-13T00:00:00Z","modified":"2026-03-14T08:26:09.361493Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"RLSA-2023:6818","title":"Important: Satellite 6.14 security and bug fix update","description":"Rocky Enterprise Software Foundation Satellite is a systems management tool for Linux-based\ninfrastructure. It allows for provisioning, remote management, and\nmonitoring of multiple Linux deployments with a single centralized tool.\n\nSecurity Fix(es):\n\n* golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) (CVE-2023-39325)\n\n* HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)\n\n* GitPython: Insecure non-multi options in clone and clone_from is not blocked (CVE-2023-40267)\n\n* kubeclient: kubeconfig parsing error can lead to MITM attacks (CVE-2022-0759)\n\n* foreman: OS command injection via ct_command and fcct_command (CVE-2022-3874)\n\n* ruby-git: code injection vulnerability (CVE-2022-46648)\n\n* ruby-git: code injection vulnerability (CVE-2022-47318)\n\n* Foreman: Arbitrary code execution through templates (CVE-2023-0118)\n\n* rubygem-activerecord: SQL Injection (CVE-2023-22794)\n\n* openssl: c_rehash script allows command injection (CVE-2022-1292)\n\n* openssl: the c_rehash script allows command injection (CVE-2022-2068)\n\n* Pulp:Tokens stored in plaintext (CVE-2022-3644)\n\n* satellite: Blind SSRF via Referer header (CVE-2022-4130)\n\n* python-future: remote attackers can cause denial of service via crafted Set-Cookie header from malicious web server (CVE-2022-40899)\n\n* golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)\n\n* rubygem-activerecord: Denial of Service (CVE-2022-44566)\n\n* rubygem-rack: denial of service in Content-Disposition parsing (CVE-2022-44570)\n\n* rubygem-rack: denial of service in Content-Disposition parsing (CVE-2022-44571)\n\n* rubygem-rack: denial of service in Content-Disposition parsing (CVE-2022-44572)\n\n* Foreman: Stored cross-site scripting in host tab (CVE-2023-0119)\n\n* puppet: Puppet Server ReDoS (CVE-2023-1894)\n\n* rubygem-actionpack: Denial of Service in Action Dispatch (CVE-2023-22792)\n\n* rubygem-actionpack: Denial of Service in Action Dispatch (CVE-2023-22795)\n\n* rubygem-activesupport: Regular Expression Denial of Service (CVE-2023-22796)\n\n* rubygem-globalid: ReDoS vulnerability (CVE-2023-22799)\n\n* rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530)\n\n* rubygem-rack: denial of service in header parsing (CVE-2023-27539)\n\n* golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)\n\n* sqlparse: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service) (CVE-2023-30608)\n\n* python-django: Potential bypass of validation when uploading multiple files using one form field (CVE-2023-31047)\n\n* python-requests: Unintended leak of Proxy-Authorization header (CVE-2023-32681)\n\n* python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator (CVE-2023-36053)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nThis update also fixes several bugs and adds various enhancements. Documentation for these changes is available from the Release Notes document linked to in the References section.","status":"published","published":"2023-11-11T22:58:57.641828Z","modified":"2026-02-05T03:30:08.284301Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2023:0276-1","title":"Security update for rubygem-rack","description":"This update for rubygem-rack fixes the following issues:\n\n- CVE-2022-44570: Fixed a potential denial of service when parsing a\n  RFC2183 multipart boundary (bsc#1207597).\n- CVE-2022-44571: Fixed a potential denial of service when parsing a\n  Range header (bsc#1207599).\n- CVE-2022-44572: Fixed a potential denial of service when parsing a\n  Content-Disposition header (bsc#1207596).\n","status":"published","published":"2023-02-06T16:19:57Z","modified":"2026-02-04T03:41:46.610493Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"USN-5910-1","title":"ruby-rack vulnerabilities","description":"It was discovered that Rack did not properly structure regular expressions\nin some of its parsing components, which could result in uncontrolled\nresource consumption if an application using Rack received specially\ncrafted input. A remote attacker could possibly use this issue to cause a\ndenial of service. (CVE-2022-44570, CVE-2022-44571)\n\nIt was discovered that Rack did not properly structure regular expressions\nin its multipart parsing component, which could result in uncontrolled\nresource consumption if an application using Rack to parse multipart posts\nreceived specially crafted input. A remote attacker could possibly use\nthis issue to cause a denial of service. This issue was only fixed in\nUbuntu 20.04 ESM and Ubuntu 22.04 ESM. (CVE-2022-44572)\n","status":"published","published":"2023-03-02T17:43:56Z","modified":"2026-06-29T13:50:48.042576301Z","updated_at":"2026-11-02T16:58:16.738762Z"},{"id":"USN-7036-1","title":"ruby-rack vulnerabilities","description":"It was discovered that Rack was not properly parsing data when processing\nmultipart POST requests. If a user or automated system were tricked into\nsending a specially crafted multipart POST request to an application using\nRack, a remote attacker could possibly use this issue to cause a denial of\nservice. (CVE-2022-30122)\n\nIt was discovered that Rack was not properly escaping untrusted data when\nperforming logging operations, which could cause shell escaped sequences\nto be written to a terminal. If a user or automated system were tricked\ninto sending a specially crafted request to an application using Rack, a\nremote attacker could possibly use this issue to execute arbitrary code in\nthe machine running the application. (CVE-2022-30123)\n\nIt was discovered that Rack did not properly structure regular expressions\nin some of its parsing components, which could result in uncontrolled\nresource consumption if an application using Rack received specially\ncrafted input. A remote attacker could possibly use this issue to cause a\ndenial of service. (CVE-2022-44570, CVE-2022-44571)\n\nIt was discovered that Rack did not properly structure regular expressions\nin its multipart parsing component, which could result in uncontrolled\nresource consumption if an application using Rack to parse multipart posts\nreceived specially crafted input. A remote attacker could possibly use\nthis issue to cause a denial of service. (CVE-2022-44572)\n\nIt was discovered that Rack incorrectly handled Multipart MIME parsing.\nA remote attacker could possibly use this issue to cause Rack to consume\nresources, leading to a denial of service. (CVE-2023-27530)\n\nIt was discovered that Rack incorrectly handled certain regular\nexpressions. A remote attacker could possibly use this issue to cause\nRack to consume resources, leading to a denial of service.\n(CVE-2023-27539)\n\nIt was discovered that Rack incorrectly parsed certain media types. A\nremote attacker could possibly use this issue to cause Rack to consume\nresources, leading to a denial of service. (CVE-2024-25126)\n\nIt was discovered that Rack incorrectly handled certain Range headers. A\nremote attacker could possibly use this issue to cause Rack to create\nlarge responses, leading to a denial of service. (CVE-2024-26141)\n\nIt was discovered that Rack incorrectly handled certain crafted headers. A\nremote attacker could possibly use this issue to cause Rack to consume\nresources, leading to a denial of service. (CVE-2024-26146)\n","status":"published","published":"2024-09-26T04:19:46Z","modified":"2026-02-10T04:45:27Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}