PT-2025-23867 · Rack · Rack

Tenderlove · Published 2025-06-04 · Updated 2025-12-29 · CVE-2025-49007

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Rack versions 3.1.0 through 3.1.15

Description The issue is a denial of service vulnerability in the Content-Disposition parsing component of Rack. It can be triggered by carefully crafted input, causing the Content-Disposition header parsing to take an unexpected amount of time, which may result in a denial of service attack. This vulnerability affects applications that parse multipart posts using Rack, including virtually all Rails applications.

Recommendations For Rack versions 3.1.0 through 3.1.15, update to version 3.1.16, which contains a patch for the vulnerability.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

CWE-1333

Related Identifiers

BDU:2025-12287

CVE-2025-49007

ECHO-192D-891B-072B

GHSA-47M2-26RW-J2JW

MGASA-2025-0334

Affected Products

Rack

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49007.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-49007.yml · Exploit
• https://github.com/rack/rack/commit/4795831a0a310c2d31102749e551b38faab6401f · Patch
• https://github.com/rack/rack/security/advisories/GHSA-47m2-26rw-j2jw · Vendor Advisory
• https://github.com/rack/rack/commit/aed514df37e33907df3c971ed3ca9a0a20ac2901 · Patch
• https://advisories.mageia.org/MGASA-2025-0334.html · Security Note
• https://ubuntu.com/security/CVE-2025-49007 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-49007 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0811SE18 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-49007 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0334 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-49007 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49007 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49007 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12287 · Security Note