REDHAT-BUG-2402174: High severity Rack Rack vulnerability
Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, Rack::Multipart::Parser buffers the entire multipart preamble (bytes before the first boundary) in memory without any size limit. A client can send a large preamble followed by a valid boundary, causing significant memory use and potential process termination due to out-of-memory (OOM) conditions. Remote attackers can trigger large transient memory spikes by including a long preamble in multipart/form-data requests. The impact scales with allowed request sizes and concurrency, potentially causing worker crashes or severe slowdown due to garbage collection. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a preamble size limit (e.g., 16 KiB) or discard preamble data entirely. Workarounds include limiting total request body size at the proxy or web server level and monitoring memory and set per-process limits to prevent OOM conditions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.2.19 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.1.17 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.2.2 - Configuration
Ensure Rack multipart parsing enforces a preamble size limit (e.g., 16 KiB) or discards multipart preamble data entirely; in affected versions, the preamble was buffered in memory without a limit.
Rack::Multipart::Parser multipart preamble size limit = 16 KiB (example) - Compensating control
Limit the total request body size at the proxy or web server level to reduce the ability of attackers to trigger large transient memory spikes.
- Compensating control
Monitor memory usage and set per-process limits to prevent OOM conditions and worker crashes during attack traffic.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2402174?
The severity of REDHAT-BUG-2402174 is high due to the potential for Denial of Service through excessive memory consumption.
How do I fix REDHAT-BUG-2402174?
To fix REDHAT-BUG-2402174, upgrade Rack to versions 2.2.19, 3.1.17, or 3.2.2 or later.
What versions are affected by REDHAT-BUG-2402174?
REDHAT-BUG-2402174 affects Rack versions prior to 2.2.19, 3.1.17, and 3.2.2.
What is the impact of not addressing REDHAT-BUG-2402174?
Failing to address REDHAT-BUG-2402174 could lead to Denial of Service, where an application could become unresponsive.
Is there a workaround for REDHAT-BUG-2402174?
A temporary workaround for REDHAT-BUG-2402174 is to limit the size of incoming payloads until an upgrade can be performed.