Skip to content
Fencer Vulns
high 7.5

CVE-2018-16470 json

Rack vulnerable to Denial of Service

published 2018-11-13 7 y ago modified 2026-06-17 4 mo ago also GHSA-hg78-4f6x-99wq , EUVD-2018-0756

cvss
7.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size.

Patch / fix

  • rubygems rack 2.0.6
  • tfm satellite capsule 6.6, satellite 6.6 5.0-7.el7sat
  • kobo satellite capsule 6.6, satellite 6.6 0.5.1-1.el7sat
  • pulp satellite capsule 6.6, satellite 6.6 2.19.1.1-1.el7sat
  • gofer satellite capsule 6.6, satellite 6.6 2.12.5-5.el7sat
  • future satellite capsule 6.6, satellite 6.6 0.16.0-11.el7sat
  • ostree satellite capsule 6.6, satellite 6.6 2017.1-2.atomic.el7
  • foreman satellite capsule 6.6, satellite 6.6 1.22.0.32-1.el7sat
  • katello satellite capsule 6.6, satellite 6.6 3.12.0-2.el7sat

red hat advisories RHSA-2019:3172

  • rmt-server SLE Module for Server Applications 15 1.1.1-3.13.1

suse advisories SUSE-SU-2019:0272-1

  • rmt-server openSUSE Tumbleweed 2.6.13-1.1

opensuse advisories openSUSE-SU-2024:10589-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-16470 updated cvss 5.3

rubygem-rack: Buffer size in multipart parser allows for denial of service

  • Red Hat Satellite 6 tfm-ror51-rubygem-rack
    affected: no fix planned “Will not fix”
  • Red Hat Satellite 6.6 tfm 5.0-7.el7sat, kobo 0.5.1-1.el7sat, gofer 2.12.5-5.el7sat, pulp 2.19.1.1-1.el7sat, tfm-ror52 1.0-4.el7sat, future 0.16.0-11.el7sat, +448 more Red Hat Satellite Capsule 6.6 tfm 5.0-7.el7sat, kobo 0.5.1-1.el7sat, gofer 2.12.5-5.el7sat, pulp 2.19.1.1-1.el7sat, tfm-ror52 1.0-4.el7sat, future 0.16.0-11.el7sat, +239 more
    fixed: vendor fix RHSA-2019:3172
  • Red Hat CloudForms Management Engine 5 cfme-gemset, dbus-api-service, cfme-amazon-smartstate Red Hat OpenShift Container Platform 3.2 rubygem-rack Red Hat OpenShift Container Platform 3.3 rubygem-rack Red Hat OpenShift Container Platform 3.4 rubygem-rack Red Hat OpenShift Enterprise 3.1 rubygem-rack Red Hat OpenStack Platform 8 (Liberty) Operational Tools rubygem-rack
    +9 more products
    Red Hat OpenStack Platform 9 (Mitaka) Operational Tools rubygem-rack Red Hat OpenStack Platform 10 (Newton) Operational Tools rubygem-rack Red Hat OpenStack Platform 12 (Pike) Operational Tools rubygem-rack Red Hat OpenStack Platform 13 (Queens) Operational Tools rubygem-rack Red Hat OpenStack Platform 14 (Rocky) Operational Tools rubygem-rack Red Hat Software Collections rh-ror42-rubygem-rack, rh-ror50-rubygem-rack Red Hat Storage 3 rubygem-rack Red Hat Subscription Asset Manager ruby193-rubygem-rack Red Hat Update Infrastructure 3 for Cloud Providers rubygem-rack
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.03% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
rubygems rack
>=2.0.4, <2.0.6
2.0.6

Affected products

  • Rack Rack

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.