CVE-2023-27539 Possible Denial of Service Vulnerability in Rack's header parsing
Attackers can cause a denial of service in Rack applications by exploiting a flaw in the header parsing component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-27539?
CVE-2023-27539 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 9 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
There is a denial of service vulnerability in the header parsing component of Rack.
Which versions are affected by CVE-2023-27539?
4 open source packages ship an affected version, including rack. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
rack RubyGems | From 2.0.0 | 2.2.6.4 |
rack RubyGems | From 2.0.0 | 2.2.6.4 |
rack RubyGems | From 3.0.0 | 3.0.6.1 |
rack RubyGems | From 3.0.0 | 3.0.6.1 |
Linux distribution packages (9)
rubygem-rack SUSE:Linux Enterprise High Availability Extension 15 SP1 | All versions | 2.0.8-150000.3.18.1 |
rubygem-rack SUSE:Linux Enterprise High Availability Extension 15 SP2 | All versions | 2.0.8-150000.3.18.1 |
rubygem-rack SUSE:Linux Enterprise High Availability Extension 15 SP3 | All versions | 2.0.8-150000.3.18.1 |
rubygem-rack SUSE:Linux Enterprise High Availability Extension 15 SP4 | All versions | 2.0.8-150000.3.18.1 |
rubygem-rack SUSE:OpenStack Cloud Crowbar 8 | All versions | 1.6.13-3.19.1 |
rubygem-rack SUSE:OpenStack Cloud Crowbar 9 | All versions | 1.6.13-3.19.1 |
rubygem-rack openSUSE:Leap 15.4 | All versions | 2.0.8-150000.3.18.1 |
rubygem-rack openSUSE:Tumbleweed | All versions | 3.0.7-1.1 |
rubygem-rack-2.2 openSUSE:Tumbleweed | All versions | 2.2.6.4-1.1 |
Products include Debian Debian Linux, Rack Rack.
How do I fix CVE-2023-27539?
Upgrade rack to a fixed version for your release line: 2.2.6.4 or 3.0.6.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-27539 being exploited?
There is no known exploitation of CVE-2023-27539 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2023-27539, GHSA-c6qg-cjj8-47qp, MGASA-2024-0042, SUSE-SU-2023:1685-1, SUSE-SU-2023:1869-1, UBUNTU-CVE-2023-27539 and 2 more.