diff --git a/backport-CVE-2022-44572.patch b/backport-CVE-2022-44572.patch
new file mode 100644
index 0000000000000000000000000000000000000000..64e2009d711c38cfcb70371f154a882b72f5940b
--- /dev/null
+++ b/backport-CVE-2022-44572.patch
@@ -0,0 +1,48 @@
+From 19e49f0f185d7e42ed5b402baec6c897a8c48029 Mon Sep 17 00:00:00 2001
+From: John Hawthorn <john@hawthorn.email>
+Date: Wed, 3 Aug 2022 00:19:56 -0700
+Subject: [PATCH] Forbid control characters in attributes
+
+This commit restricts the characters accepted in ATTRIBUTE_CHAR,
+forbidding control characters and fixing a ReDOS vulnerability.
+
+This also now should fully follow the RFCs.
+
+RFC 2231, Section 7 specifies:
+
+    attribute-char := <any (US-ASCII) CHAR except SPACE, CTLs,
+                         "*", "'", "%", or tspecials>
+
+RFC 2045, Appendix A specifies:
+
+    tspecials :=  "(" / ")" / "<" / ">" / "@" /
+                  "," / ";" / ":" / "\" / <">
+                  "/" / "[" / "]" / "?" / "="
+
+RFC 822, Section 3.3 specifies:
+
+    CTL         =  <any ASCII control           ; (  0- 37,  0.- 31.)
+                    character and DEL>          ; (    177,     127.)
+    SPACE       =  <ASCII SP, space>            ; (     40,      32.)
+
+[CVE-2022-44572]
+---
+ lib/rack/multipart.rb | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/rack/multipart.rb b/lib/rack/multipart.rb
+index 10f8e5fa..7695fe76 100644
+--- a/lib/rack/multipart.rb
++++ b/lib/rack/multipart.rb
+@@ -21,7 +21,7 @@ module Rack
+     MULTIPART_CONTENT_DISPOSITION = /Content-Disposition:.*;\s*name=(#{VALUE})/ni
+     MULTIPART_CONTENT_ID = /Content-ID:\s*([^#{EOL}]*)/ni
+     # Updated definitions from RFC 2231
+-    ATTRIBUTE_CHAR = %r{[^ \t\v\n\r)(><@,;:\\"/\[\]?='*%]}
++    ATTRIBUTE_CHAR = %r{[^ \x00-\x1f\x7f)(><@,;:\\"/\[\]?='*%]}
+     ATTRIBUTE = /#{ATTRIBUTE_CHAR}+/
+     SECTION = /\*[0-9]+/
+     REGULAR_PARAMETER_NAME = /#{ATTRIBUTE}#{SECTION}?/
+-- 
+2.39.0.windows.2
+
diff --git a/rubygem-rack.spec b/rubygem-rack.spec
index 23d26e9d1eca25896453a2c135be4f0e1fe83fa6..db01685d1d81bc24693a3ffd10d873a5648f7f32 100644
--- a/rubygem-rack.spec
+++ b/rubygem-rack.spec
@@ -3,13 +3,14 @@
 Name:    rubygem-%{gem_name}
 Version: 2.2.3.1
 Epoch:   1
-Release: 2
+Release: 3
 Summary: A modular Ruby webserver interface
 License: MIT and BSD
 URL:     https://rack.github.io/
 Source0: https://rubygems.org/downloads/%{gem_name}-%{version}.gem
 
 Patch6000: backport-CVE-2022-44570.patch
+Patch6001: backport-CVE-2022-44572.patch
 
 BuildRequires: ruby(release) rubygems-devel ruby >= 2.2.2 memcached
 BuildArch: noarch
@@ -37,6 +38,7 @@ Documentation for %{name}.
 %prep
 %setup -q -n %{gem_name}-%{version}
 %patch6000 -p1
+%patch6001 -p1
 
 %build
 gem build ../%{gem_name}-%{version}.gemspec
@@ -94,6 +96,9 @@ popd
 %doc %{gem_instdir}/contrib
 
 %changelog
+* Sun Dec 24 2023 mengwenhua <mengwenhua@xfusion.com> - 1:2.2.3.1-3
+- fix CVE-2022-44572
+
 * Thu Dec 21 2023 mengwenhua <mengwenhua@xfusion.com> - 1:2.2.3.1-2
 - fix CVE-2022-44570