← Vulnerability feed

Vulnerability record · CVE-2012-6109 · published 1 March 2013

CVE-2012-6109: Rack project rack vulnerability

Rack Project · Rack

lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.

4.3 CVSS 2.0 Medium EPSS 2.7% · top 14.5%
4.3CVSS 2.0 base score
2.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
14References
16 Jun 2026Last modified by NVD

Description

lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.

AV:N/AC:M/Au:N/C:N/I:N/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://rack.github.com/
http://rhn.redhat.com/errata/RHSA-2013-0544.html
http://rhn.redhat.com/errata/RHSA-2013-0548.html
https://bugzilla.redhat.com/show_bug.cgi?id=895277
https://github.com/rack/rack/blob/master/README.rdoc
https://github.com/rack/rack/commit/c9f65df37a151821eb88ddd1dc404b83e52c52d5
https://groups.google.com/forum/#%21msg/rack-devel/1w4_fWEgTdI/XAkSNHjtdTsJ
http://rack.github.com/
http://rhn.redhat.com/errata/RHSA-2013-0544.html
http://rhn.redhat.com/errata/RHSA-2013-0548.html
https://bugzilla.redhat.com/show_bug.cgi?id=895277
https://github.com/rack/rack/blob/master/README.rdoc
https://github.com/rack/rack/commit/c9f65df37a151821eb88ddd1dc404b83e52c52d5
https://groups.google.com/forum/#%21msg/rack-devel/1w4_fWEgTdI/XAkSNHjtdTsJ

Track CVE-2012-6109 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2022-30123Rack project rack vulnerabilityA sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and Common…EPSS 1.9%8.6CVE-2020-8161Rack project rack path traversal vulnerabilityA directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory a…EPSS 3.4%7.5CVE-2022-30122Rack project rack uncontrolled resource consumption vulnerabilityA possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.EPSS 2.2%7.5CVE-2020-8184Rack project rack improper input validation vulnerabilityA reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an…EPSS 2.9%7.5CVE-2018-16470Rack project rack uncontrolled resource consumption vulnerabilityThere is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to ente…EPSS 2.0%6.1CVE-2018-16471Rack project rack cross-site scripting vulnerabilityThere is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method…EPSS 1.9%5.1CVE-2013-0263Rack project rack vulnerabilityRack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote a…EPSS 5.4%5.0CVE-2015-3225Rack project rack vulnerabilitylib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to …EPSS 8.0%

Source: NIST National Vulnerability Database (record CVE-2012-6109), CISA KEV, FIRST EPSS (scores of 2026-10-01). This page is refreshed as NVD updates the record.