The Ruby Rack web server interface contains an uncontrolled resource consumption vulnerability that allows unauthenticated remote attackers to cause denial of service via memory exhaustion.

This flaw exists within the Rack::Multipart::Parser component, which fails to restrict the memory allocation for non-file form fields. An unauthenticated attacker can submit crafted multipart requests containing massive text fields to consume available system memory, leading to worker crashes or total service unavailability.

The exploitation of this vulnerability directly threatens the availability of web applications relying on the Rack interface. By forcing out of memory conditions, attackers can disrupt critical business operations, resulting in significant service downtime and potential cascading failures across application infrastructure. Given the CVSS score of 7.5, this high-severity vulnerability must be prioritized to ensure platform stability and service continuity.

Immediate Action: Update the Rack gem to version 2.2.19, 3.1.17, or 3.2.2 as appropriate for your current environment.

Proactive Monitoring: Monitor application server logs and system metrics for sudden spikes in memory consumption or repeated worker process restarts during multipart form submissions.

Compensating Controls: Implement request size limits at the reverse proxy or web server layer, such as the Nginx client_max_body_size directive, to drop excessively large requests before they reach the application.

Public Exploit Available: Unknown

Organizations utilizing Ruby-based web frameworks must treat this advisory with high urgency. Because the vulnerability is automatable and targets a fundamental component of the application stack, the risk of disruption is substantial. Administrators should prioritize the application of the patched versions and verify that existing proxy-level request size limits are configured to provide a baseline defense until updates can be deployed.