PT-2025-23867 · Rack · Rack

Tenderlove · Publicado 2025-06-04 · Atualizado 2025-12-29 · CVE-2025-49007

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Rack versions 3.1.0 through 3.1.15

Description The issue is a denial of service vulnerability in the Content-Disposition parsing component of Rack. It can be triggered by carefully crafted input, causing the Content-Disposition header parsing to take an unexpected amount of time, which may result in a denial of service attack. This vulnerability affects applications that parse multipart posts using Rack, including virtually all Rails applications.

Recommendations For Rack versions 3.1.0 through 3.1.15, update to version 3.1.16, which contains a patch for the vulnerability.

Exploit

Correção

DoS

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

CWE-1333

Identificadores relacionados

BDU:2025-12287

CVE-2025-49007

ECHO-192D-891B-072B

GHSA-47M2-26RW-J2JW

MGASA-2025-0334

Produtos afetados

Rack

Referências · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49007.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-49007.yml · Exploit
• https://github.com/rack/rack · Nota
• https://github.com/rack/rack/commit/4795831a0a310c2d31102749e551b38faab6401f · Correção
• https://github.com/rack/rack/security/advisories/GHSA-47m2-26rw-j2jw · Aviso do Fabricante
• https://github.com/rack/rack/commit/aed514df37e33907df3c971ed3ca9a0a20ac2901 · Correção
• https://t.me/cvetracker/25454 · Publicação no Telegram
• https://advisories.mageia.org/MGASA-2025-0334.html · Nota de Segurança
• https://ubuntu.com/security/CVE-2025-49007 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2025-49007 · Aviso do Fabricante
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0811SE18 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-49007 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2025-0334 · Aviso do Fabricante
• https://twitter.com/rubylandnews/status/1930691199112757488 · Publicação no Twitter
• https://t.me/cvenotify/124693 · Publicação no Telegram