Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-sw69-1r7d-kkht
Vulnerability ID VCID-sw69-1r7d-kkht
Aliases CVE-2018-16470
GHSA-hg78-4f6x-99wq
Summary Uncontrolled Resource Consumption There is a possible DoS vulnerability in the multipart parser in Rack. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-400 Uncontrolled Resource Consumption
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.5 https://access.redhat.com/errata/RHSA-2019:3172
generic_textual HIGH https://access.redhat.com/errata/RHSA-2019:3172
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-16470.json
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2018-16470
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2018-16470
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2018-16470
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2018-16470
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2018-16470
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2018-16470
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2018-16470
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2018-16470
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2018-16470
epss 0.00177 https://api.first.org/data/v1/epss?cve=CVE-2018-16470
cvssv3 5.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-hg78-4f6x-99wq
cvssv3.1 7.5 https://github.com/rack/rack
generic_textual HIGH https://github.com/rack/rack
cvssv3.1 7.5 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2018-16470.yml
generic_textual HIGH https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2018-16470.yml
cvssv3.1 7.5 https://groups.google.com/forum/#!msg/rubyonrails-security/U_x-YkfuVTg/xhvYAmp6AAAJ
generic_textual HIGH https://groups.google.com/forum/#!msg/rubyonrails-security/U_x-YkfuVTg/xhvYAmp6AAAJ
cvssv3 7.5 https://groups.google.com/forum/#!topic/ruby-security-ann/Dz4sRl-ktKk
cvssv3.1 7.5 https://groups.google.com/forum/#!topic/ruby-security-ann/Dz4sRl-ktKk
generic_textual HIGH https://groups.google.com/forum/#!topic/ruby-security-ann/Dz4sRl-ktKk
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2018-16470
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2018-16470
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2019:3172
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-16470.json
https://api.first.org/data/v1/epss?cve=CVE-2018-16470
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/rack/rack
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2018-16470.yml
https://groups.google.com/forum/#!msg/rubyonrails-security/U_x-YkfuVTg/xhvYAmp6AAAJ
https://groups.google.com/forum/#!topic/ruby-security-ann/Dz4sRl-ktKk
1646814 https://bugzilla.redhat.com/show_bug.cgi?id=1646814
913003 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=913003
CVE-2018-16470 https://nvd.nist.gov/vuln/detail/CVE-2018-16470
GHSA-hg78-4f6x-99wq https://github.com/advisories/GHSA-hg78-4f6x-99wq
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/errata/RHSA-2019:3172
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-16470.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/rack/rack
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2018-16470.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://groups.google.com/forum/#!msg/rubyonrails-security/U_x-YkfuVTg/xhvYAmp6AAAJ
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://groups.google.com/forum/#!topic/ruby-security-ann/Dz4sRl-ktKk
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2018-16470
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.39117
EPSS Score 0.00177
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:48:08.701439+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/rack/CVE-2018-16470.yml 38.0.0