Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

The core issue lies in how Rack::Multipart::Parser handles non-file form fields. Unlike file parts, which are streamed to temporary files, these non-file fields are stored entirely in memory as Ruby String objects. An attacker can craft a request containing a single, very large text field (hundreds of megabytes or more) within the multipart/form-data payload. This will cause the Rack application to allocate a significant amount of memory to store the field, potentially exceeding available resources and triggering an out-of-memory error. The impact is a denial of service, rendering the Rack application or the entire web server unresponsive. This could disrupt critical services and potentially lead to data loss if the application was in the process of handling sensitive information.

Applications and services built on Ruby Rack, particularly those handling user-uploaded data or processing large form submissions, are at risk. Shared hosting environments where multiple applications share the same server resources are especially vulnerable, as a single malicious request could impact all hosted applications. Legacy Rack deployments using older versions are also at increased risk.

• linux / server:

journalctl -u your_rack_app -g 'out of memory' --since "1 hour ago"

• generic web:

curl -v -X POST -F 'large_field=ThisIsAVeryLongString' http://your-rack-app/form_handler 2>&1 | grep -i 'out of memory'

1. 2025-10-07Disclosure

   disclosure

1. Gereserveerd2025-09-30
2. Gepubliceerd2025-10-07
3. Gewijzigd2026-02-04
4. EPSS bijgewerkt2026-03-23

The primary mitigation is to upgrade to Rack version 2.2.19 or later, which addresses the vulnerability by limiting the size of non-file form fields. If upgrading is not immediately feasible, consider implementing temporary workarounds. One approach is to configure the web server or application to limit the maximum size of multipart/form-data requests. Another option is to implement a WAF (Web Application Firewall) rule to block requests exceeding a certain size threshold. Carefully test any configuration changes to avoid unintended consequences. After upgrading, confirm the fix by sending a large multipart/form-data request and verifying that the application does not experience an out-of-memory error.