Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rack | rubygems | < 2.2.19 | 2.2.19 |
| rack | rubygems | >= 3.1, < 3.1.17 | 3.1.17 |
| rack | rubygems | >= 3.2, < 3.2.2 | 3.2.2 |
Miggo AIRoot Cause AnalysisThe vulnerability, as described, lies in the unbounded buffering of multipart part headers within Rack's multipart parser. The provided commit patches clearly show modifications to the lib/rack/multipart/parser.rb file to address this issue. Specifically, the handle_mime_head method, which is responsible for processing these headers, is modified across all supplied patches. Before the fix, if the terminating CRLFCRLF was not found in the incoming data stream for a part's header, the parser would simply return :want_read, causing it to append more data to its internal buffer (@sbuf) without any size constraints. The patches introduce a size check (@sbuf.string.bytesize > MIME_HEADER_BYTESIZE_LIMIT) within this method. If the buffer grows beyond a newly defined limit (MIME_HEADER_BYTESIZE_LIMIT, set to 64KB), an exception is raised, thus preventing the unbounded memory growth. Therefore, Rack::Multipart::Parser.handle_mime_head is the precise function that contains the vulnerability. During exploitation, a profiler would show this function being called repeatedly as it consumes the malicious, unterminated header data, leading to a spike in memory usage until the process is terminated.
