ruby-rack: Rack is a modular Ruby web server interface

Rack is a modular Ruby web server interface. Prior to versions 2.2.14,3.0.16, and 3.1.14, `Rack::QueryParser` parses query strings and`application/x-www-form-urlencoded` bodies into Ruby data structureswithout imposing any limit on the number of parameters, allowing attackersto send requests with extremely large numbers of parameters. Thevulnerability arises because `Rack::QueryParser` iterates over each`&`-separated key-value pair and adds it to a Hash without enforcing anupper bound on the total number of parameters. This allows an attacker tosend a single request containing hundreds of thousands (or more) ofparameters, which consumes excessive memory and CPU during parsing. Anattacker can trigger denial of service by sending specifically crafted HTTPrequests, which can cause memory exhaustion or pin CPU resources, stallingor crashing the Rack server. This results in full service disruption untilthe affected worker is restarted. Versions 2.2.14, 3.0.16, and 3.1.14 fixthe issue. Some other mitigations are available. One may use middleware toenforce a maximum query string size or parameter count, or employ a reverseproxy (such as Nginx) to limit request sizes and reject oversized querystrings or bodies. Limiting request body sizes and query string lengths atthe web server or CDN level is an effective mitigation.

Where it's fixed