CVE-2022-44570 Denial of service via header parsing in Rack
Attackers can cause denial of service in Rack-based applications by sending crafted Range headers that trigger excessive processing time.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-44570?
CVE-2022-44570 is a high-severity denial of service vulnerability in https://github.com/rack/rack, published on 9 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.
Which versions are affected by CVE-2022-44570?
8 open source packages ship an affected version, including rack. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rack RubyGems | From 1.5.0 | 2.0.9.2 |
rack RubyGems | From 1.5.0 | 2.0.9.2 |
rack RubyGems | From 2.1.0.0 | 2.1.4.2 |
rack RubyGems | From 2.1.0.0 | 2.1.4.2 |
rack RubyGems | From 2.2.0.0 | 2.2.6.2 |
rack RubyGems | From 2.2.0.0 | 2.2.6.2 |
2 more packages
rack RubyGems | From 3.0.0.0 | 3.0.4.1 |
rack RubyGems | From 3.0.0.0 | 3.0.4.1 |
Products include Rack Rack.
How do I fix CVE-2022-44570?
Upgrade rack to a fixed version for your release line: 2.0.9.2, 2.1.4.2, 2.2.6.2 or 3.0.4.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-44570 being exploited?
There is no known exploitation of CVE-2022-44570 in the wild and no public exploit code.
Other vulnerabilities in https://github.com/rack/rack
- CVE-2026-34785 Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching
- CVE-2026-34827 Rack: Algorithmic-Complexity DoS in Rack::Multipart::Parser
- CVE-2026-34829 Rack: Denial of Service via Unbounded Multipart File Upload Without Content-Length
- CVE-2026-22860 Rack has a Directory Traversal via Rack:Directory
- CVE-2025-61919 Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing
Sources
Also known as DEBIAN-CVE-2022-44570, GHSA-65f5-mfpf-vfhj, UBUNTU-CVE-2022-44570.