CVE-2023-27530

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-27530
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-27530.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-27530
Aliases
Downstream
Related
Published
2023-03-10T00:00:00Z
Modified
2026-05-01T04:18:40.359759Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected.

Database specific 
{
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27530.json",
    "cna_assigner": "hackerone",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "last_affected": "3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/rack/rack

Affected ranges

Type
GIT
Repo
https://github.com/rack/rack
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9996d403584fb7609708f582f7647868b4444949
Introduced
879ae7163a399a9ed36d876668f4ecae4ae8b9e4
Fixed
7bdc55dd21ec76811ad74c1ae14c1588d2f2ca49
Introduced
39d501a28c1fe51284addfe6dacffafb69d49849
Fixed
d6b5b2bab88f458fb048133604faebea952d8133
Introduced
52901caf09ebcda879512a8605059963a49df55d
Fixed
5c18f306ef0d26917d490aa1f686dd68de738384
Database specific 
{
    "cpe": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.9.3"
        },
        {
            "introduced": "2.1.0"
        },
        {
            "fixed": "2.1.4.3"
        },
        {
            "introduced": "2.2.0"
        },
        {
            "fixed": "2.2.6.3"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.4.2"
        }
    ],
    "source": "CPE_FIELD"
}

Affected versions

0.*
0.1
0.2
0.3
1.*
1.0
1.3.0
1.3.0.beta
1.3.0.beta2
1.4.0
1.4.1
1.5.0
1.5.1
1.6.0.beta
2.*
2.0.0
2.0.0.alpha
2.0.0.rc1
2.0.1
2.0.2
2.0.3
2.0.4
2.0.6
2.0.7
2.0.8
2.0.9
2.0.9.1
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.2.0
2.2.3
2.2.4
3.*
3.0.0
v2.*
v2.0.9.2
v2.1.4.2
v2.2.1
v2.2.2
v2.2.5
v2.2.6
v2.2.6.1
v2.2.6.2
v3.*
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.4.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-27530.json"