-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rack | rubygems | >= 2.0.0, < 2.0.9.2 | 2.0.9.2 |
| rack | rubygems | >= 2.1.0.0, < 2.1.4.2 | 2.1.4.2 |
| rack | rubygems | >= 2.2.0.0, < 2.2.6.1 | 2.2.6.1 |
| rack | rubygems | >= 3.0.0.0, < 3.0.4.1 | 3.0.4.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from inefficient regex handling in multipart boundary parsing (CWE-1333). The patches explicitly forbid control characters in attributes, indicating the vulnerable functions were involved in parsing multipart headers/boundaries. Rack's multipart parser (parser.rb) is the logical component handling this logic. The combination of CWE-1333 reference and the patch's focus on attribute validation strongly points to regex-based parsing functions in this module as the root cause.
RubyRubyOngoing coverage of React2Shell