Rack::Directory builds a regular expression by interpolating the configured root path. When that path contains regex metacharacters such as +, *, or ., the regex is malformed and prefix stripping fails. The generated directory listing may then expose the full filesystem path in the HTML output, and the malformed regex can trigger a denial‑of‑service condition by causing unexpected errors. This vulnerability is a form of improper input processing, reflected in the listed weaknesses.

The vulnerability affects all releases of Rack prior to 2.2.23, 3.1.21, and 3.2.6 when the Rack::Directory middleware is used to browse directories. Applications that rely on earlier versions of Rack and configure a root path containing regex metacharacters are susceptible.

The CVSS score of 5.3 represents moderate severity, while the EPSS score below 1% suggests a low, though present, likelihood of exploitation. The issue is not documented in the KER catalog. An attacker can trigger the flaw through an unauthenticated HTTP request that causes Rack::Directory to process a root path with regex metacharacters, leading to information disclosure and potential service interruption. Evidence of a direct exploitation pathway is implied by the nature of the vulnerability, but no public exploit has been identified.