CoreCVE
Back

HIGH

rubygem-rack: Buffer size in multipart parser allows for denial of service

Published Nov 13, 2018

Description

There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size.

Affected products

Remediation

Red Hat statement

OpenShift Enterprise and Red Hat OpenStack Platform optools both ship rubygem-rack 1.5.2, which is not affected by this flaw. Red Hat Subscription Asset Manager uses rubygem-rack 1.4.5, and is not affected by this flaw. Red Hat Update Infrastructure ships rubygem-rack version 1.4.2, which is not affected by this flaw. Red Hat CloudForms versions 4.5 and 4.6 ship rack version 2.0.3, which is not affected by this flaw; while Red Hat CloudForms version 4.7 ships rack version 2.0.6, which already contains the fix for this flaw.

Metrics

Weaknesses (1)

CWE-400

Uncontrolled Resource Consumption

References (10)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner hackerone
Published Nov 13, 2018
Updated Aug 5, 2024
Reserved Sep 4, 2018
Link CVE-2018-16470
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2018-16470
Red Hat
Severity Moderate
Public date Nov 6, 2018
Links CVE-2018-16470 - Bugzilla
GHSA-HG78-4F6X-99WQ