7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.001 Low
EPSS
Percentile
36.8%
There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.
Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3
The Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.
All users running an affected release should either upgrade or use one of the workarounds immediately.
A proxy can be configured to limit the POST body size which will mitigate this issue.
discuss.rubyonrails.org/t/cve-2023-27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388
github.com/advisories/GHSA-3h57-hmj3-gj3p
github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2023-27530.yml
lists.debian.org/debian-lts-announce/2023/04/msg00017.html
nvd.nist.gov/vuln/detail/CVE-2023-27530
security.netapp.com/advisory/ntap-20231208-0015/
www.debian.org/security/2023/dsa-5530