Rack is a modular Ruby web‑server interface. In versions older than 2.2.23, 3.1.21, and 3.2.6 the multipart parser does not wrap the request body in a bounded stream when the request lacks a Content‑Length header. Consequently, the parser streams the entire payload until the end of the stream, writing file parts directly to a temporary file on disk without any size limit. An attacker can therefore upload an arbitrarily large multipart file and exhaust available disk space, causing the application to become unresponsive.

All Rack applications that use the rack library prior to the patched releases are affected. The vulnerability applies to deployments that accept multipart/form‑data via the rack interface. The issue has been resolved in rack releases 2.2.23, 3.1.21, and 3.2.6.

The CVSS score of 7.5 indicates a high impact, and the vulnerability is exploitable by any user capable of sending HTTP requests; no authentication is required. Based on the description, it is inferred that an attacker can trigger the denial of service by sending a multipart/form‑data request without a Content‑Length header, such as using chunked transfer encoding. EPSS data is not available and the vulnerability is not yet listed in the CISA KEV catalog, but the combination of unauthenticated access and the ability to consume disk space makes this a serious risk for affected deployments.