CVE-2012-6109

Published: Mar 1, 2013Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.

Affected (25)

Products: Rack Project: Rack

Rack Project

1 product

Rack

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Rack Project Rack	Up to 1.1.3
Rack Project Rack	Version 0.1
Rack Project Rack	Version 0.2
Rack Project Rack	Version 0.3
Rack Project Rack	Version 0.4
Rack Project Rack	Version 0.9.1
Rack Project Rack	Version 0.9
Rack Project Rack	Version 1.0.0
Rack Project Rack	Version 1.0.1
Rack Project Rack	Version 1.1.0
Rack Project Rack	Version 1.1.2

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Rack Project Rack	Version 1.2.0
Rack Project Rack	Version 1.2.1
Rack Project Rack	Version 1.2.2
Rack Project Rack	Version 1.2.3
Rack Project Rack	Version 1.2.4

Configuration C

7 vulnerable

Vulnerable Software	Affected Versions
Rack Project Rack	Version 1.3.0
Rack Project Rack	Version 1.3.1
Rack Project Rack	Version 1.3.2
Rack Project Rack	Version 1.3.3
Rack Project Rack	Version 1.3.4
Rack Project Rack	Version 1.3.5
Rack Project Rack	Version 1.3.6