Rack vulnerable to Denial of Service via large parameter depth request (GHSA-rgr4-9jh5-j4j6)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2015-3225
Severity: MODERATE · CWE: 

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.

Affected packages:
package: ecosystem: RubyGems
name: rack
ranges: type: ECOSYSTEM
events: introduced: 1.5.0
fixed: 1.5.4
package: ecosystem: RubyGems
name: rack
ranges: type: ECOSYSTEM
events: introduced: 1.6.0
fixed: 1.6.2
package: ecosystem: RubyGems
name: rack
ranges: type: ECOSYSTEM
events: introduced: 1.4.0
fixed: 1.4.6