Rack rubygems receiving excessively long lines triggers out-of-memory error (GHSA-3pxh-h8hw-mj8w)
Published: 2017-10-24T18:33:37Z
Aliases: CVE-2013-0183
Severity: MODERATE · CWE: CWE-119
CWE-400

multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.

Affected packages:
package: ecosystem: RubyGems
name: rack
ranges: type: ECOSYSTEM
events: introduced: 1.3.0
fixed: 1.3.8
package: ecosystem: RubyGems
name: rack
ranges: type: ECOSYSTEM
events: introduced: 1.4.0
fixed: 1.4.3