CVE-2022-45442: Debian Linux

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue.

Affected products

• Debian Debian Linux: version 10.0 only
• Sinatrarb Sinatra: from 2.0.0, before 2.2.3 (fixed in 2.2.3); from 3.0.0, before 3.0.4 (fixed in 3.0.4)

Published 2022-11-28. Last modified 2026-06-17.