CVE-2022-44570: 
Ruby vulnerability analysis and mitigation

A denial of service vulnerability (CVE-2022-44570) was discovered in the Range header parsing component of Rack versions 1.5.0 and later. The vulnerability was disclosed on January 17, 2023, affecting the Rack web server interface, which is commonly used in Ruby web applications (Ruby Rails Discussion).

The vulnerability exists in the Range header parsing component where carefully crafted input can cause the parsing process to take an unexpected amount of time. This vulnerability has been assigned a CVSS score of 7.5 (HIGH) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NetApp Security).

When successfully exploited, this vulnerability could lead to a denial of service (DoS) attack. Applications that deal with Range requests, such as streaming applications or applications that serve files, are particularly vulnerable to this issue (Ruby Rails Discussion).

The vulnerability has been fixed in Rack versions 2.0.9.2, 2.1.4.2, 2.2.6.1, and 3.0.4.1. Users are advised to upgrade to these fixed versions as there are no feasible workarounds for this issue. For users unable to upgrade immediately, patches have been provided for different release series (Ruby Rails Discussion).