{"action":"Upgrade rack to 2.0.9.2 or later.","affected":[{"fixed":"2.0.9.2","introduced":"1.5.0"},{"fixed":"2.1.4.2","introduced":"2.1.0.0"},{"fixed":"2.2.6.2","introduced":"2.2.0.0"},{"fixed":"3.0.4.1","introduced":"3.0.0.0"}],"component":"rack","cve_ids":["CVE-2022-44570"],"ecosystem":"RubyGems","epss":0.01626,"exploited":false,"fixed_versions":["2.0.9.2","2.1.4.2","2.2.6.2","3.0.4.1"],"ghsa_id":"GHSA-65f5-mfpf-vfhj","id":"tcs_01M5KEH7MX3Y01X2Y52WC3SYR9","modified_at":"2025-02-13T19:05:53.024751Z","published_at":"2023-01-18T18:19:33Z","references":["https://osv.dev/vulnerability/GHSA-65f5-mfpf-vfhj","https://nvd.nist.gov/vuln/detail/CVE-2022-44570","https://discuss.rubyonrails.org/t/cve-2022-44570-possible-denial-of-service-vulnerability-in-racks-range-header-parsing/82125","https://github.com/rack/rack","https://github.com/rack/rack/releases/tag/v3.0.4.1","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2022-44570.yml","https://security.netapp.com/advisory/ntap-20231208-0010","https://www.debian.org/security/2023/dsa-5530"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-65f5-mfpf-vfhj","url":"https://osv.dev/vulnerability/GHSA-65f5-mfpf-vfhj"}],"summary":"Denial of service via header parsing in Rack"}