--- title: "CVE-2022-44572\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2022-44572?format=md keywords: index, follow --- # CVE-2022-44572 Publication date 9 February 2023 Last updated 25 August 2025 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) ## Cvss 3 Severity Score **7.5 · High** [Score breakdown](https://ubuntu.com/security/CVE-2022-44572?format=md#impact-score) Toggle side navigation ## Description A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. [Read the notes from the security team](https://ubuntu.com/security/CVE-2022-44572?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | ruby-rack | 25.04 plucky | Not affected | | 24.10 oracular | Not affected | | 24.04 LTS noble | Not affected | | 23.10 mantic | Not affected | | 23.04 lunar | Not affected | | 22.10 kinetic | Ignored end of life, was needed | | 22.04 LTS jammy | Fixed 2.1.4-5ubuntu1.1 | | 20.04 LTS focal | Fixed 2.0.7-2ubuntu0.1+esm3 Ubuntu Pro | | 18.04 LTS bionic | Not affected | | 16.04 LTS xenial | Not affected | | 14.04 LTS trusty | Not affected | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) * [Patch details](https://ubuntu.com/security/CVE-2022-44572?format=md#patch-details) ### Get expanded security coverage with Ubuntu Pro Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use. [Get Ubuntu Pro](https://ubuntu.com/pro) [30-day free trial](https://ubuntu.com/pro/free-trial) ## Notes --- ### [ccdm94](https://launchpad.net/~ccdm94) variable related to the regular expression that causes the DoS was introduced in commit b3e90edf, together with RFC 2231 changes. ### Patch details For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) | Package | Patch details | | --- | --- | | ruby-rack | * Upstream: [dc50f8e](https://github.com/rack/rack/commit/dc50f8e495f67eb933b1fc33ebee550908d945e6) * Upstream: [8291f50](https://github.com/rack/rack/commit/8291f502b0e1dcf514cc25c34e4bf0beec7a92ae) * Upstream: [19e49f0](https://github.com/rack/rack/commit/19e49f0f185d7e42ed5b402baec6c897a8c48029) | ## Severity score breakdown CVSS version: CVSS v3.0 **Base score** 7.5 · High * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Network | | Attack complexity | Low | | Privileges required | None | | User interaction | None | | Scope | Unchanged | | Confidentiality impact | None | | Integrity impact | None | | Availability impact | High | * Scores | Parameter | Value | | --- | --- | | Base score | 7.5 · High | | Exploitability score | - | | Impact score | - | **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-44572) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-44572) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2022-44572) * [Debian](https://security-tracker.debian.org/tracker/CVE-2022-44572) ### Related Ubuntu Security Notices (USN) + [USN-5910-1](https://usn.ubuntu.com/USN-5910-1) + Rack vulnerabilities + 2 March 2023 + [USN-7036-1](https://usn.ubuntu.com/USN-7036-1) + Rack vulnerabilities + 26 September 2024 ### Other references * * * *