Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: rack/rack
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v3.2.1
Choose a base ref
...
head repository: rack/rack
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v3.2.2
Choose a head ref
  • 3 commits
  • 5 files changed
  • 2 contributors

Commits on Oct 7, 2025

  1. Fix denial of service vulnerbilties in multipart parsing 

    Two separate vulnerabilities:

1. Unbounded buffering of uploaded data waiting for a boundary.

2. Unbounded buffering of uploaded data waiting for complete
   mime part header.

The respective limits are 16KB for (1) and 64KB for (2), but those
limits only apply for non-default buffer sizes. If left at the
default configuration, 1MB (default buffer size) will be the limit
for both.

This changes one EmptyContentError exception to an Error exception,
but EmptyContentError is probably the wrong error to raise for a
very long boundary.
    @jeremyevans @ioquatix
    jeremyevans authored and ioquatix committed Oct 7, 2025
    Configuration menu
    Copy the full SHA
    589127f View commit details
    Browse the repository at this point in the history

  2. Limit amount of retained data when parsing multipart requests 

    The limit is 16MB by default, and it can be adjusted with the
RACK_MULTIPART_MAX_BUFFERED_UPLOAD_SIZE environment variable.

Data stored in temporary files is not counted against this limit.
However data for other parameters, as well as the data for the
mime headers for each parameter (which is retained during parsing)
is counted against the limit.
    @jeremyevans @ioquatix
    jeremyevans authored and ioquatix committed Oct 7, 2025
    Configuration menu
    Copy the full SHA
    3beacfc View commit details
    Browse the repository at this point in the history

  3. Bump patch version.

    @ioquatix
    ioquatix committed Oct 7, 2025
    Configuration menu
    Copy the full SHA
    bce149b View commit details
    Browse the repository at this point in the history
Loading