CVE-2025-49007: rack
Vulnerability summary
CVE-2025-49007 is a medium (CVSS 6.6) vulnerability in rack. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 6Timeline
- 04-06-2025PublishedVulnerability first disclosed.
- 05-06-2025Last modifiedVulnerability information updated.
Description
Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571. Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. Version 3.1.16 contains a patch for the vulnerability.
CVSS metrics
8 scores · 7 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- OSV · RubygemsEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:UDiffers
- NVDNIST6.6MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.56%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
0.00 pp
From 0.56% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
- CWE-1333Inefficient Regular Expression ComplexityThe product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Affected systems
Chainguard19 products
- logstash-8-with-output-opensearch< 8.18.2-r1
- ruby3.2-rails-7.1< 7.1.5.1-r8
- ruby3.2-rails-7.1-compat< 7.1.5.1-r8
- ruby3.2-rails-7.2< 7.2.2.1-r8
- ruby3.2-rails-7.2-compat< 7.2.2.1-r8
Debian1 product
- ruby-rack< 3.1.16-0.1
Rack1 product
- rack≥ 3.1.0, < 3.1.16
RubyGems1 product
- rack≥ 3.1.0, < 3.1.16
Ubuntu1 product
- ruby-rackAll versions (No fix recorded)
Wolfi1 product
- logstash-8-with-output-opensearch< 8.18.2-r1
6 vendors · 24 products
References
10 links- github.com/rack/rack/security/advisories/GHSA-47m2-26rw-j2jwX Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
- github.com/rack/rack/commit/4795831a0a310c2d31102749e551b38faab6401fX Refsource MISCREPORTFIXWEBPatch
- github.com/rack/rack/commit/aed514df37e33907df3c971ed3ca9a0a20ac2901X Refsource MISCREPORTFIXWEBPatch
- github.com/rack/rackPACKAGE