-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rack | rubygems | < 2.2.18 | 2.2.18 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in how Rack's query parser handles parameter limits. The description and the provided patch clearly indicate that the check_query_string function in lib/rack/query_parser.rb is the source of the vulnerability. The patch modifies this function to correctly count both '&' and ';' as parameter separators when enforcing the params_limit. The previous implementation only counted '&', which allowed an attacker to bypass the limit by using semicolons, potentially leading to a denial of service through resource exhaustion. The functions parse_query and parse_nested_query call check_query_string, making them the entry points for the vulnerable logic, but the root cause is within check_query_string itself.
RubyRuby