{"id":"CVE-2022-30122","published":"2022-12-05T00:00:00Z","modified":"2024-11-19T20:16:22Z","title":"A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing…","vendor":null,"product":null,"tier":"tail","description":{"text":"A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02231,"percentile":0.82697,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://discuss.rubyonrails.org/t/cve-2022-30122-denial-of-service-vulnerability-in-rack-multipart-parsing/80729","tags":[]},{"url":"https://www.debian.org/security/2023/dsa-5530","tags":["vendor-advisory"]},{"url":"https://security.gentoo.org/glsa/202310-18","tags":["vendor-advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20231208-0012/","tags":[]}],"priority":{"score":16.5,"factors":[{"name":"EPSS percentile","points":16.54}]},"affectedVersions":[{"vendor":"n/a","product":"https://github.com/rack/rack","versions":["2.0.9.1, 2.1.4.1, 2.2.3.1"]}],"affected":[{"ecosystem":"RubyGems","package":"rack","vulnerableRanges":[">=1.2, <2.0.9.1",">=2.1, <2.1.4.1",">=2.2, <2.2.3.1"],"patched":["2.0.9.1","2.1.4.1","2.2.3.1"],"from":["GHSA-hxqx-xwvh-44m2"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4248","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-rack-cve-2022-30122","packageHistory":[{"cve":"CVE-2019-16782","published":"2019-12-18","fixed":"2.0.8","kev":false},{"cve":"CVE-2020-8161","published":"2020-07-02","fixed":"2.1.3","kev":false},{"cve":"CVE-2020-8184","published":"2020-06-19","fixed":"2.2.3","kev":false},{"cve":"CVE-2022-30122","published":"2022-12-05","fixed":"2.2.3.1","kev":false},{"cve":"CVE-2022-30123","published":"2022-12-05","fixed":"2.2.3.1","kev":false},{"cve":"CVE-2025-32441","published":"2025-05-07","fixed":"2.2.14","kev":false},{"cve":"CVE-2025-59830","published":"2025-09-25","fixed":"2.2.18","kev":false},{"cve":"CVE-2022-44570","published":"2023-02-09","fixed":"3.0.4.1","kev":false,"link":{"from":"CVE-2022-30122","to":"CVE-2022-44570","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:rack","fromFixed":"2.0.9.1","toFixed":"2.0.9.2","daysApart":66}]}},{"cve":"CVE-2022-44571","published":"2023-02-09","fixed":"3.0.4.1","kev":false,"link":{"from":"CVE-2022-30122","to":"CVE-2022-44571","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:rack","fromFixed":"2.0.9.1","toFixed":"2.0.9.2","daysApart":66}]}},{"cve":"CVE-2022-44572","published":"2023-02-09","fixed":"3.0.4.1","kev":false,"link":{"from":"CVE-2022-30122","to":"CVE-2022-44572","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:rack","fromFixed":"2.0.9.1","toFixed":"2.0.9.2","daysApart":66},{"kind":"similar","provenance":"machine","score":0.48,"basis":"same package + description similarity"}]}}],"package":"RubyGems:rack"}}