A denial of service vulnerability exists in the Ruby Rack web server interface in versions from 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6. The vulnerability arises from inefficient parsing of multipart form-data parameters with heavy escaping, causing excessive CPU consumption. This can be triggered by an unauthenticated attacker sending crafted multipart/form-data requests. The issue has been patched in versions 3.1.21 and 3.2.6.