{"id":"CVE-2025-49007","aliases":["DEBIAN-CVE-2025-49007","EUVD-2025-16936","GHSA-47m2-26rw-j2jw","MGASA-2025-0334","UBUNTU-CVE-2025-49007"],"status":"published","title":"ReDoS Vulnerability in Rack::Multipart handle_mime_head","description":"Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571. Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. Version 3.1.16 contains a patch for the vulnerability.","severity":{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00584,"percentile":0.48378,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333","CWE-770"],"published":"2025-06-04T22:42:52Z","modified":"2026-10-28T02:30:55Z","fixes":[{"ecosystem":"RubyGems","package":"rack","fixed_in":["3.1.16"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"ruby-rack","fixed_in":["3.1.16-0.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-rack","fixed_in":["3.1.16-0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.16"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.16-0.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.16-0.1"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.0"},{"fixed":"3.1.16"}]}],"versions":["3.1.0","3.1.1","3.1.10","3.1.11","3.1.12","3.1.13","3.1.14","3.1.15","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9"]},{"source":"osv","ecosystem":"Mageia:9","package":"ruby-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.21-1.mga9"}]}],"bundled":8}],"products":[{"vendor":"rack","product":"rack"}],"references":[{"url":"https://github.com/rack/rack/security/advisories/GHSA-47m2-26rw-j2jw","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/rack/rack/commit/4795831a0a310c2d31102749e551b38faab6401f","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/rack/rack/commit/aed514df37e33907df3c971ed3ca9a0a20ac2901","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49007","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-49007.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-47m2-26rw-j2jw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49007.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-49007","tags":["advisory"]},{"url":"https://github.com/rack/rack","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0334.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34755","tags":["report"]},{"url":"https://rack.github.io/rack/3.2/CHANGELOG_md.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-49007","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-49007","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-49007","title":"ReDoS Vulnerability in Rack::Multipart handle_mime_head","description":"Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571. Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. Version 3.1.16 contains a patch for the vulnerability.","status":"published","published":"2025-06-04T22:42:52.515Z","modified":"2025-06-05T14:11:25.234Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:32:24.473448Z"}],"euvd":[{"id":"EUVD-2025-16936","description":"Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571. Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. Version 3.1.16 contains a patch for the vulnerability.","status":"published","published":"2025-06-04T22:42:52Z","modified":"2025-06-05T14:11:25Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"}],"updated_at":"2026-11-02T20:32:29.13667Z"}],"ghsa":[{"id":"GHSA-47m2-26rw-j2jw","title":"ReDoS Vulnerability in Rack::Multipart handle_mime_head","description":"### Summary\nThere is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571.\n\n### Details\n\nCarefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.\n\n### Credits\n\nThanks to [scyoon](https://hackerone.com/scyoon) for reporting this to the Rails security team","status":"published","published":"2025-06-05T05:21:34Z","modified":"2025-06-05T20:15:09Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:38:45.948817Z"}],"nvd":[{"id":"CVE-2025-49007","description":"Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571. Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. Version 3.1.16 contains a patch for the vulnerability.","status":"published","published":"2025-06-04T23:15:21.54Z","modified":"2026-06-17T09:30:39.667Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-770","CWE-1333"],"updated_at":"2026-11-02T14:11:10.8732Z"}],"osv":[{"id":"CVE-2025-49007","title":"ReDoS Vulnerability in Rack::Multipart handle_mime_head","description":"Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571. Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. Version 3.1.16 contains a patch for the vulnerability.","status":"published","published":"2025-06-04T22:42:52.515Z","modified":"2026-10-28T02:30:55.278895282Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"DEBIAN-CVE-2025-49007","description":"Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571. Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. Version 3.1.16 contains a patch for the vulnerability.","status":"published","published":"2025-06-04T23:15:21.54Z","modified":"2026-09-01T20:05:53.171777073Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"GHSA-47m2-26rw-j2jw","title":"ReDoS Vulnerability in Rack::Multipart handle_mime_head","description":"### Summary\nThere is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571.\n\n### Details\n\nCarefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.\n\n### Credits\n\nThanks to [scyoon](https://hackerone.com/scyoon) for reporting this to the Rails security team","status":"published","published":"2025-06-05T05:21:34Z","modified":"2026-09-10T03:50:24.787595818Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"UBUNTU-CVE-2025-49007","description":"Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571. Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. Version 3.1.16 contains a patch for the vulnerability.","status":"withdrawn","published":"2025-06-04T23:15:00Z","modified":"2025-07-14T04:43:10Z","cvss":[{"version":"4.0","score":6.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"MGASA-2025-0334","title":"Updated ruby-rack packages fix security vulnerabilities","description":"Unbounded-Parameter DoS in Rack::QueryParser. (CVE-2025-46727)\nReDoS Vulnerability in Rack::Multipart handle_mime_head.\n(CVE-2025-49007)\nRack QueryParser has an unsafe default allowing params_limit bypass via\nsemicolon-separated parameters. (CVE-2025-59830)\nRack's unbounded multipart preamble buffering enables DoS (memory\nexhaustion). (CVE-2025-61770)\nRack's multipart parser buffers large non‑file fields entirely in\nmemory, enabling DoS (memory exhaustion). (CVE-2025-61771)\nRack's multipart parser buffers unbounded per-part headers, enabling DoS\n(memory exhaustion). (CVE-2025-61772)\nRack is vulnerable to a memory-exhaustion DoS through unbounded\nURL-encoded body parsing. (CVE-2025-61919)\nRack has Possible Information Disclosure Vulnerability. (CVE-2025-61780)\n","status":"published","published":"2025-12-29T20:41:12Z","modified":"2026-04-16T04:43:56.798658566Z","updated_at":"2026-11-02T15:49:43.178336Z"}]}}