CVE-2022-44571

CVE-2022-44571 is a denial-of-service vulnerability in the Content-Disposition parsing component of Rack, affecting versions prior to 2.0.9.2, 2.1.4.2, 2.2.4.1, and 3.0.0.1. An unauthenticated attacker can craft a malicious Content-Disposition header in a multipart post, causing Rack to consume excessive processing time. This can lead to a denial-of-service against applications, including virtually all Rails applications, that parse multipart posts using Rack. The vulnerability has a CVSS score of 7.5 (HIGH) due to its network attack vector and low attack complexity, with a high impact on availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.