| Package | Affected versions | Patched versions |
|---|---|---|
| rack | ≥ 1.2.0, < 1.2.6≥ 1.3.0, < 1.3.7≥ 1.4.0, < 1.4.2< 1.1.4 | 1.2.61.3.71.4.21.1.4 |
| rack | = 0.1= 0.2= 0.3= 0.4= 0.9= 0.9.1= 1.0.0= 1.0.1= 1.1.0= 1.1.2= 1.2.0= 1.2.1= 1.2.2= 1.2.3= 1.2.4= 1.3.0= 1.3.1= 1.3.2= 1.3.3= 1.3.4= 1.3.5= 1.3.6= 1.4.0= 1.4.1≤ 1.1.3 |
lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free