Rack is a modular Ruby web server interface. In versions prior to 2.2.23, 3.1.21, and 3.2.6, the method used to choose the response encoding is vulnerable to a quadratic time complexity attack when the Accept‑Encoding header contains many wildcard entries. An unauthenticated attacker can send a single request with a maliciously crafted Accept‑Encoding header and cause disproportionate CPU consumption in the compression middleware path. This results in a denial of service condition for any application that uses Rack::Deflater. The CVSS score of 5.3 indicates a moderate severity and the vulnerability is not listed in the known exploited vulnerabilities catalog.

Ruby web applications that use the Rack library and enable the Rack::Deflater middleware are affected. The vulnerability exists in all older releases of Rack before versions 2.2.23, 3.1.21, and 3.2.6. Upgrading to the patched releases eliminates the problem.

The risk is moderate but the attack can be performed without authentication from anywhere on the internet by sending a specially crafted HTTP request. Although no EPSS score is available, the moderate CVSS score combined with the ability to trigger a CPU‑heavy loop makes the vulnerability potentially exploitable against poorly protected services. The lack of a KEV listing suggests no widespread exploitation yet, but the simple request‑based nature warrants prompt patching.