Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.select_best_encoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard (*) entries. Because this method is used by Rack::Deflater to choose a response encoding, an unauthenticated attacker can send a single request with a crafted Accept-Encoding header and cause disproportionate CPU consumption on the compression middleware path. This results in a denial of service condition for applications using Rack::Deflater. This issue has been patched in versions 2.2.23, 3.1.21, and 3.2.6.
2.2.4-32.2.7-12.2.7-1ubuntu0.12.2.7-1ubuntu0.22.2.7-1ubuntu0.32.2.7-1ubuntu0.42.2.7-1ubuntu0.52.2.7-1ubuntu0.62.2.7-1ubuntu0.72.2.7-1.13.1.16-0.13.1.16-0.1ubuntu0.13.1.16-0.1ubuntu0.23.1.16-0.1ubuntu0.31.5.2-11.5.2-1ubuntu0.1~esm11.5.2-3+deb8u3ubuntu1~esm101.5.2-3+deb8u3ubuntu1~esm111.5.2-3+deb8u3ubuntu1~esm21.5.2-3+deb8u3ubuntu1~esm31.5.2-3+deb8u3ubuntu1~esm41.5.2-3+deb8u3ubuntu1~esm61.5.2-3+deb8u3ubuntu1~esm71.5.2-3+deb8u3ubuntu1~esm8+1 more1.5.2-41.6.4-21.6.4-31.6.4-3ubuntu0.11.6.4-3ubuntu0.21.6.4-3ubuntu0.2+esm11.6.4-3ubuntu0.2+esm101.6.4-3ubuntu0.2+esm21.6.4-3ubuntu0.2+esm41.6.4-3ubuntu0.2+esm5+4 more1.6.4-41.6.4-4ubuntu0.11.6.4-4ubuntu0.21.6.4-4ubuntu0.2+esm11.6.4-4ubuntu0.2+esm101.6.4-4ubuntu0.2+esm21.6.4-4ubuntu0.2+esm41.6.4-4ubuntu0.2+esm51.6.4-4ubuntu0.2+esm61.6.4-4ubuntu0.2+esm7+2 more2.0.6-32.0.7-22.0.7-2ubuntu0.12.0.7-2ubuntu0.1+esm12.0.7-2ubuntu0.1+esm102.0.7-2ubuntu0.1+esm22.0.7-2ubuntu0.1+esm32.0.7-2ubuntu0.1+esm42.0.7-2ubuntu0.1+esm52.0.7-2ubuntu0.1+esm6+3 more2.1.4-32.1.4-42.1.4-52.1.4-5ubuntu12.1.4-5ubuntu1+esm22.1.4-5ubuntu1+esm32.1.4-5ubuntu1+esm42.1.4-5ubuntu1+esm52.1.4-5ubuntu1.12.1.4-5ubuntu1.1+esm1+5 moreExploitability
AV:NAC:LPR:NUI:NScope
S:UImpact
C:NI:NA:LCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L