Rack::Utils.select_best_encoding operates with quadratic time complexity when parsing Accept-Encoding headers that contain many wildcard (*) entries. The method is called by the Rack::Deflater middleware to decide which compression format to use for responses. An unauthenticated attacker can construct a single HTTP request with a crafted Accept-Encoding header that forces Rack::Deflater to exercise the quadratic algorithm, exhausting CPU resources. The result is a denial‑of‑service condition for any application that relies on Rack::Deflater, as legitimate requests may be delayed or dropped.

The issue affects any Ruby web application that uses the Rack library prior to release 2.2.23, 3.1.21, or 3.2.6. The vulnerability is documented by the rack:rack CNA. Upgrading to the corresponding patch release or later eliminates the vulnerability.

The CVSS score of 5.3 reflects moderate severity; the EPSS score of less than 1% and the absence from the CISA KEV list suggest a low probability of widespread exploitation. Nevertheless the flaw is remote and unauthenticated, requires only a single crafted HTTP request, and can cause immediate service disruption when the vulnerable Rack version is in use.