6.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-49007

CVE-2025-49007: ReDoS Vulnerability in Rack::Multipart handle_mime_head

Summary

There is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571.

Details

Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.

Credits

Thanks to scyoon for reporting this to the Rails security team

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-49007

CVE-2025-49007:

6.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
rack	rubygems	>= 3.1.0, < 3.1.16	3.1.16

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Regular Expression Denial of Service (ReDoS) located in the multipart parsing component of Rack, specifically when processing the Content-Disposition header. The advisory's title, 'ReDoS Vulnerability in Rack::Multipart handle_mime_head', directly points to the affected function or method. The provided commit patches (e.g., 4795831a0a310c2d31102749e551b38faab6401f) show modifications to regular expressions within lib/rack/multipart/parser.rb. The key change was to the MULTIPART_CONTENT_DISPOSITION regex. The original regex, /Content-Disposition:(.*)(?=#{EOL}(\S|\z))/ni, was prone to catastrophic backtracking because it was not anchored to the start of the line and used a greedy (.*) followed by a lookahead. This allowed crafted inputs to cause significant processing delays. The Rack::Multipart::Parser#handle_mime_head method is the component that would use this regex to parse the Content-Disposition header. The fix involved anchoring the regex with ^ and using more precise definitions for whitespace and header values, thus preventing the ReDoS. While other regexes for Content-Type and Content-ID were also updated for consistency and robustness, the primary reported ReDoS was tied to Content-Disposition processing within handle_mime_head.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.