Rack, a modular Ruby web server interface, contains a flaw in its multipart parsing component (Rack::Multipart::Parser). When reading a multipart request that ends inside or immediately after multipart headers, the parser can retain data in an internal StringScanner buffer. An attacker may craft many small parts aligned with the buffer size boundary so the buffer grows beyond the per-field, header, and preamble limits, exhausting the worker’s memory and causing the application to become unresponsive. The vulnerability is purely a denial‑of‑service issue with no direct impact on confidentiality or integrity.

The vulnerability affects the Rack project (rack:rack) for all releases prior to 2.2.25, 3.1.23, and 3.2.8. Any Ruby application that processes multipart requests with those versions is susceptible.

The CVSS score of 7.5 indicates a high severity of this memory exhaustion flaw. EPSS is not available and the issue is not listed in CISA’s KEV catalog. The attacker only needs to send a well‑formed multipart body; therefore the attack can be executed remotely over HTTP without any authentication. Because the flaw requires reaching the multipart parser and aligning payload boundaries, the practical exploitation requires careful request construction, but the potential for a DoS remains significant for exposed applications. The lack of a publicly available exploit in KEV does not reduce the risk, as the flaw is straightforward for an attacker with knowledge of multipart formats to trigger.