CVE-2023-27530

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-770

Affected software

Vendor	Product	Versions
n/a	https://github.com/rack/rack	3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3

References

https://discuss.rubyonrails.org/t/cve-2023-27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00017.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20231208-0015/
https://www.debian.org/security/2023/dsa-5530Third Party Advisory
https://discuss.rubyonrails.org/t/cve-2023-27530-possible-dos-vulnerability-in-multipart-mime-parsing/82388Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00017.htmlMailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20231208-0015/
https://www.debian.org/security/2023/dsa-5530Third Party Advisory

Timeline

Published: Mar 10, 2023
Last modified: Oct 24, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-275315.3There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code CVE-2023-275327.5Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This CVE-2023-275338.8A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on mali CVE-2023-275348.8A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as CVE-2023-275355.9An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials bei CVE-2023-275365.9An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connecti CVE-2023-275375.9A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without CVE-2023-275385.5An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite the CVE-2023-275395.3There is a denial of service vulnerability in the header parsing component of Rack.CVE-2023-27546.8The Cloudflare WARP client for Windows assigns loopback IPv4 addresses for the DNS Servers, since WARP acts as local DNS server that perform CVE-2023-275407.5IBM Watson CP4D Data Stores 4.6.0 does not properly allocate resources without limits or throttling which could allow a remote attacker with CVE-2023-275455.5IBM Watson CloudPak for Data Data Stores information disclosure 4.6.0 allows web pages to be stored locally which can be read by another use