Log in Start free

Vulnerability · Published Jan 9, 2025 · Assigned by hackerone

CVE-2023-27539

Medium 5.3

In plain English

A medium-severity security flaw in Rack from Rails. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)1.1%top 35.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

There is a denial of service vulnerability in the header parsing component of Rack.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8pcs0.10.15-4.el8_8.1.almaALSA-2023:3082
AlmaLinux:9pcs0.11.4-7.el9_2ALSA-2023:2652
AlmaLinux:8pcs-snmp0.10.15-4.el8_8.1.almaALSA-2023:3082
AlmaLinux:9pcs-snmp0.11.4-7.el9_2ALSA-2023:2652
Debian:12ruby-rack2.2.6.4-1DEBIAN-CVE-2023-27539
Debian:13ruby-rack2.2.6.4-1DEBIAN-CVE-2023-27539
Debian:14ruby-rack2.2.6.4-1DEBIAN-CVE-2023-27539
Rocky Linux:8pcs0:0.10.15-4.el8_8.1RLSA-2023:3082
Rocky Linux:9pcs0:0.11.4-7.el9_2RLSA-2023:2652
RubyGemsrack2.2.6.4GHSA-c6qg-cjj8-47qp
RubyGemsrack3.0.6.1GHSA-c6qg-cjj8-47qp
Ubuntu:22.04:LTSruby-rack2.1.4-5ubuntu1.1UBUNTU-CVE-2023-27539
Ubuntu:22.04:LTSruby-rack2.1.4-5ubuntu1.1USN-7036-1

Affected products (as reported)

VendorProductVersions
Rails Rack 2.2.6.4 – before 2.2.6.43.0.6.1 – before 3.0.6.1

References