# Rainbows! 0.91.1 - use a less-broken parser from Unicorn **URL:** \ **Category:** Ruby\ **Created:** [April 19, 2010, 11:25pm UTC](https://www.ruby-forum.com/t/rainbows-0-91-1-use-a-less-broken-parser-from-unicorn/187214 "2010-04-19T23:25:55Z")\ **Posts on this page:** 4\ **Page:** 1

**Author:** ![ericw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/97f17d/32.png) [@ericw](https://www.ruby-forum.com/u/ericw)\ **Post date:** [April 19, 2010, 11:25pm UTC](https://www.ruby-forum.com/t/rainbows-0-91-1-use-a-less-broken-parser-from-unicorn/187214/1 "2010-04-19T23:25:55Z")

Rainbows! is an HTTP server for sleepy Rack applications. It is based on Unicorn, but designed to handle applications that expect long request/response times and/or slow clients. For Rack applications not heavily bound by slow external network dependencies, consider Unicorn instead as it simpler and easier to debug. - [http://rainbows.rubyforge.org/](http://rainbows.rubyforge.org/) - removed\_email\_address@domain.invalid - git://git.bogomips.org/rainbows.git Changes: This release fixes a denial-of-service vector for deployments exposed directly to untrusted clients. The HTTP parser in Unicorn \<= 0.97.0 would trip an assertion (killing the associated worker process) on invalid Content-Length headers instead of raising an exception. Since Rainbows! and Zbatery supports multiple clients per worker process, all clients connected to the worker process that hit the assertion would be aborted. Deployments behind nginx are _not_ affected by this bug, as nginx will reject clients that send invalid Content-Length headers. The status of deployments behind other HTTP-aware proxies is unknown. Deployments behind a non-HTTP-aware proxy (or no proxy at all) are certainly affected by this DoS. Users are strongly encouraged to upgrade as soon as possible, there are no other changes besides this bug fix from Rainbows! 0.91.0 nor Unicorn 0.97.0 This bug affects all previously released versions of Rainbows! and Zbatery. ---

**Author:** ![ericw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/97f17d/32.png) [@ericw](https://www.ruby-forum.com/u/ericw)\ **Post date:** [April 19, 2010, 11:27pm UTC](https://www.ruby-forum.com/t/rainbows-0-91-1-use-a-less-broken-parser-from-unicorn/187214/2 "2010-04-19T23:27:05Z")

Unicorn is an HTTP server for Rack applications designed to only serve fast clients on low-latency, high-bandwidth connections and take advantage of features in Unix/Unix-like kernels. Slow clients should only be served by placing a reverse proxy capable of fully buffering both the the request and response in between Unicorn and slow clients. - [http://unicorn.bogomips.org/](http://unicorn.bogomips.org/) - removed\_email\_address@domain.invalid - git://git.bogomips.org/unicorn.git Changes: This release fixes a denial-of-service vector for derived servers exposed directly to untrusted clients. This bug does not affect most Unicorn deployments as Unicorn is only supported with trusted clients (such as nginx) on a LAN. nginx is known to reject clients that send invalid Content-Length headers, so any deployments on a trusted LAN and/or behind nginx are safe. Servers affected by this bug include (but are not limited to) Rainbows! and Zbatery. This bug does not affect Thin nor Mongrel, as neither got the request body filtering treatment that the Unicorn HTTP parser got in August 2009. The bug fixed in this release could result in a denial-of-service as it would trigger a process-wide assertion instead of raising an exception. For servers such as Rainbows!/Zbatery that serve multiple clients per worker process, this could abort all clients connected to the particular worker process that hit the assertion. ---

**Author:** ![ericw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/97f17d/32.png) [@ericw](https://www.ruby-forum.com/u/ericw)\ **Post date:** [April 19, 2010, 11:44pm UTC](https://www.ruby-forum.com/t/rainbows-0-91-1-use-a-less-broken-parser-from-unicorn/187214/3 "2010-04-19T23:44:04Z")

Oops, I got the subject line and version wrong :x ---

**Author:** ![ericw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/97f17d/32.png) [@ericw](https://www.ruby-forum.com/u/ericw)\ **Post date:** [April 19, 2010, 11:28pm UTC](https://www.ruby-forum.com/t/rainbows-0-91-1-use-a-less-broken-parser-from-unicorn/187214/4 "2010-04-19T23:28:51Z")

Zbatery is an HTTP server for Rack applications on systems that either do not support fork(), or have no memory (nor need) to run the master/worker model. It is based on Rainbows! (which is based on Unicorn (which is based on Mongrel)) and inherits parts of each. Zbatery supports your choice of all the thread/fiber/event/actor-based concurrency models and Rack middleware that Rainbows! supports (or will ever support) in a single process. - [http://zbatery.bogomip.org/](http://zbatery.bogomip.org/) - removed\_email\_address@domain.invalid - git://git.bogomips.org/zbatery.git Changes: This release fixes a denial-of-service vector for deployments exposed directly to untrusted clients. The HTTP parser in Unicorn \<= 0.97.0 would trip an assertion (killing the associated worker process) on invalid Content-Length headers instead of raising an exception. Since Rainbows! and Zbatery supports multiple clients per worker process, all clients connected to the worker process that hit the assertion would be aborted. Deployments behind nginx are _not_ affected by this bug, as nginx will reject clients that send invalid Content-Length headers. The status of deployments behind other HTTP-aware proxies is unknown. Deployments behind a non-HTTP-aware proxy (or no proxy at all) are certainly affected by this DoS. Users are strongly encouraged to upgrade as soon as possible, there are no other changes besides this bug fix from Rainbows! 0.91.0 nor Unicorn 0.97.0 This bug affects all previously released versions of Rainbows! and Zbatery.