REDHAT-BUG-2403180: High severity Rack Rack vulnerability
Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, Rack::Request#POST reads the entire request body into memory for Content-Type: application/x-www-form-urlencoded, calling rack.input.read(nil) without enforcing a length or cap. Large request bodies can therefore be buffered completely into process memory before parsing, leading to denial of service (DoS) through memory exhaustion. Users should upgrade to Rack version 2.2.20, 3.1.18, or 3.2.3, anu of which enforces form parameter limits using queryparser.bytesizelimit, preventing unbounded reads of application/x-www-form-urlencoded bodies. Additionally, enforce strict maximum body size at the proxy or web server layer (e.g., Nginx clientmaxbodysize, Apache LimitRequestBody).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 2.2.20 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.1.18 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.2.3 - Configuration
Enforce strict maximum request body size at the proxy or web server layer. For Nginx set `client_max_body_size` to a strict value; for Apache set `LimitRequestBody` to a strict value to prevent large bodies from reaching the app layer.
Proxy/Web Server (example: Nginx or Apache) client_max_body_size / LimitRequestBody = Set a strict maximum body size (limit request bodies to a safe upper bound)
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2403180?
The severity of REDHAT-BUG-2403180 is classified as critical due to its potential to cause denial of service through excessive memory consumption.
How do I fix REDHAT-BUG-2403180?
To fix REDHAT-BUG-2403180, upgrade to Rack version 2.2.20, 3.1.18, or 3.2.3 or later.
What versions are affected by REDHAT-BUG-2403180?
Versions of Rack prior to 2.2.20, 3.1.18, and 3.2.3 are affected by REDHAT-BUG-2403180.
What types of content does REDHAT-BUG-2403180 affect?
REDHAT-BUG-2403180 primarily affects request bodies with 'Content-Type: application/x-www-form-urlencoded'.
What risks does REDHAT-BUG-2403180 pose?
REDHAT-BUG-2403180 poses risks of denial of service as large request bodies may exhaust server memory.