CVE-2025-49007 Overview
CVE-2025-49007 is a denial of service vulnerability in the Content-Disposition parsing component of Rack, a modular Ruby web server interface. This vulnerability affects Rack versions starting from 3.1.0 and prior to 3.1.16. The flaw is similar to a previous security issue tracked as CVE-2022-44571, where carefully crafted input can cause Content-Disposition header parsing to take an unexpected amount of time, potentially resulting in a denial of service attack.
The Content-Disposition header is typically used in multipart parsing operations. Since virtually all Rails applications parse multipart posts using Rack, this vulnerability has a broad impact across the Ruby web application ecosystem.
Critical Impact
Attackers can exploit this ReDoS (Regular Expression Denial of Service) vulnerability to cause application unavailability by sending specially crafted multipart requests that trigger exponential regex backtracking in Content-Disposition header parsing.
Affected Products
- Rack versions 3.1.0 through 3.1.15
- Ruby on Rails applications using vulnerable Rack versions
- Any Ruby web application utilizing Rack's multipart parsing functionality
Discovery Timeline
- 2025-06-04 - CVE-2025-49007 published to NVD
- 2025-10-10 - Last updated in NVD database
Technical Details for CVE-2025-49007
Vulnerability Analysis
This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-1333 (Inefficient Regular Expression Complexity). The root cause lies in the regular expression patterns used for parsing Content-Disposition headers in Rack's multipart parser component.
The vulnerability can be exploited over the network without requiring authentication or user interaction. When exploited successfully, an attacker can cause high availability impact to the target application, effectively rendering it unresponsive to legitimate requests.
Root Cause
The vulnerable code resides in lib/rack/multipart/parser.rb. The original implementation used a regular expression pattern for MULTIPART_CONTENT_DISPOSITION that was susceptible to catastrophic backtracking when processing maliciously crafted input. The pattern /Content-Disposition:(.*)(?=#{EOL}(\S|\z))/ni allowed for excessive backtracking due to the greedy (.*) quantifier combined with the lookahead assertion.
Attack Vector
An attacker can exploit this vulnerability by sending HTTP multipart requests containing specially crafted Content-Disposition headers. The malicious headers are designed to trigger exponential backtracking in the vulnerable regular expression, causing the server to consume excessive CPU resources while processing the request. This effectively blocks the application from handling legitimate traffic.
# Vulnerable regex patterns (before patch)
MULTIPART_CONTENT_TYPE = /Content-Type:[ \t]*(.*)#{EOL}/ni
MULTIPART_CONTENT_DISPOSITION = /Content-Disposition:(.*)(?=#{EOL}(\S|\z))/ni
MULTIPART_CONTENT_ID = /Content-ID:[ \t]*([^\#{EOL}]*)/ni
# Fixed regex patterns (after patch)
FWS = /[ \t]+(?:\r\n[ \t]+)?/ # whitespace with optional folding
HEADER_VALUE = "(?:[^\r\n]|\r\n[ \t])*" # anything but a non-folding CRLF
MULTIPART_CONTENT_TYPE = /^Content-Type:#{FWS}?(#{HEADER_VALUE})/ni
MULTIPART_CONTENT_DISPOSITION = /^Content-Disposition:#{FWS}?(#{HEADER_VALUE})/ni
MULTIPART_CONTENT_ID = /^Content-ID:#{FWS}?(#{HEADER_VALUE})/ni
Source: GitHub Security Patch
Detection Methods for CVE-2025-49007
Indicators of Compromise
- Unusual CPU spikes on web application servers when processing multipart requests
- Increased request processing times for endpoints accepting file uploads
- Application timeouts or unresponsiveness during multipart form submissions
- Log entries showing abnormally long request durations for multipart/form-data requests
Detection Strategies
- Monitor application performance metrics for sudden increases in CPU utilization during HTTP request processing
- Implement request timeout monitoring to detect requests taking abnormally long to complete
- Analyze web server logs for patterns of repeated multipart requests targeting the same endpoints
- Deploy application performance monitoring (APM) to track regex execution times in Ruby applications
Monitoring Recommendations
- Configure alerting for sustained high CPU usage on application servers running Rack-based applications
- Implement request duration thresholds and alert when multipart parsing exceeds expected timeframes
- Monitor for repeated requests from single IP addresses targeting file upload endpoints
- Review Rack and Rails application logs for parsing errors or timeout exceptions
How to Mitigate CVE-2025-49007
Immediate Actions Required
- Upgrade Rack to version 3.1.16 or later immediately
- Review all Ruby on Rails applications in your environment for vulnerable Rack versions
- Implement request timeout limits at the web server or load balancer level as a temporary measure
- Consider rate limiting multipart form submissions until patches can be applied
Patch Information
The vulnerability has been fixed in Rack version 3.1.16. The patch rewrites the vulnerable regular expressions to use more efficient patterns that prevent catastrophic backtracking. The fix introduces proper header value matching with the HEADER_VALUE pattern and optional folding whitespace handling via the FWS pattern.
For detailed patch information, refer to:
Workarounds
- Configure web server timeouts to limit maximum request processing time
- Implement request body size limits to reduce the attack surface for malicious multipart payloads
- Deploy a Web Application Firewall (WAF) with rules to detect and block abnormally large or malformed Content-Disposition headers
- Consider using a reverse proxy to terminate and validate multipart requests before they reach the application
# Example: Update Rack gem to patched version
bundle update rack --conservative
# Verify installed version
bundle show rack
# Expected output: rack-3.1.16 or higher
# Alternative: Pin to patched version in Gemfile
echo 'gem "rack", ">= 3.1.16"' >> Gemfile
bundle install
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
