DoS Vulnerability in Rack's Multipart Parser Leading to Resource Exhaustion

CVE-2018-16470

What is CVE-2018-16470?

A Denial of Service vulnerability exists in the multipart parser of Rack, affecting versions prior to 2.0.6. This vulnerability allows attackers to send specially crafted requests, triggering the parser to enter a pathological state. As a result, the parser consumes excessive CPU resources in relation to the size of the request, potentially disrupting service and affecting application performance.

References