Multiple vulnerabilities have been reported in Rack, which can be exploited by malicious people to cause a DoS (Denial of Service).

1) The vulnerability is caused due to an error in regular expressions engine used by Ruby while parsing content with a certain content-disposition header and can be exploited to trigger an infinite loop.

2) The vulnerability is caused due to an unspecified error in Rack::Auth::AbstractRequest class and can be exploited to render the application unusable.

3) The vulnerability is caused due to an unspecified error when processing long strings and can be exploited to trigger an out-of-memory condition.

The vulnerabilities are reported in versions prior to 1.1.5, 1.2.7, 1.3.9, and 1.4.4.

Solution
Update to version 1.1.5, 1.2.7, 1.3.9, or 1.4.4.

Provided and/or discovered by
1) Paul Rogers
2, 3) Reported by the vendor

Original Advisory
Rack:
https://groups.google.com/forum/#!msg/rack-devel/1w4_fWEgTdI/XAkSNHjtdTsJ
https://groups.google.com/forum/#!topic/rack-devel/ImYOqcGiksw/discussion
https://groups.google.com/forum/#!topic/rack-devel/-MWPHDeGWtI/discussion

RedHat Bugzilla:
https://bugzilla.redhat.com/show_bug.cgi?id=895277
https://bugzilla.redhat.com/show_bug.cgi?id=895282
https://bugzilla.redhat.com/show_bug.cgi?id=895384

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers