ReDoS Vulnerability in Rack::Multipart handle_mime_head
SummaryThere is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571.DetailsCarefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.CreditsThanks to [scyoon](https://hackerone.com/scyoon) for reporting this to the Rails security team