Every CVE Search/ Get API key

CVE-2025-61772

Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

7.5 HighFix available

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, Rack::Multipart::Parser can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (CRLFCRLF). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected. Versions 2.2.19, 3.1.17, and 3.2.2 cap per-part header size (e.g., 64 KiB). As a workaround, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx client_max_body_size).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.93%Up 0.8 points since Oct 8, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.5

Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, Rack::Multipart::Parser can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (CRLFCRLF). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected. Versions 2.2.19, 3.1.17, and 3.2.2 cap per-part header size (e.g., 64 KiB). As a workaround, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx client_max_body_size).

Record
CVE-2025-61772
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2025-32055 7.5

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, Rack::Multipart::Parser can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (CRLFCRLF). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected. Versions 2.2.19, 3.1.17, and 3.2.2 cap per-part header size (e.g., 64 KiB). As a workaround, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx client_max_body_size).

Record
EUVD-2025-32055
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-wpv5-97wm-hp9c 7.5

Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

Summary

Rack::Multipart::Parser can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (CRLFCRLF). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS).

Details

While reading multipart headers, the parser waits for CRLFCRLF using:

@sbuf.scan_until(/(.*?\r\n)\r\n/m)

If the terminator never appears, it continues appending data (@sbuf.concat(content)) indefinitely. There is no limit on accumulated header bytes, so a single malformed part can consume memory proportional to the request body size.

Impact

Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected.

Mitigation

  • Upgrade to a patched Rack version that caps per-part header size (e.g., 64 KiB).
  • Until then, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx client_max_body_size).
Record
GHSA-wpv5-97wm-hp9c
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
NVD 7.5

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, Rack::Multipart::Parser can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (CRLFCRLF). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected. Versions 2.2.19, 3.1.17, and 3.2.2 cap per-part header size (e.g., 64 KiB). As a workaround, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx client_max_body_size).

Record
CVE-2025-61772
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSV 7.5

Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, Rack::Multipart::Parser can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (CRLFCRLF). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected. Versions 2.2.19, 3.1.17, and 3.2.2 cap per-part header size (e.g., 64 KiB). As a workaround, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx client_max_body_size).

Record
CVE-2025-61772
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVDEBIAN-CVE-2025-61772 7.5

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, Rack::Multipart::Parser can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (CRLFCRLF). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected. Versions 2.2.19, 3.1.17, and 3.2.2 cap per-part header size (e.g., 64 KiB). As a workaround, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx client_max_body_size).

Record
DEBIAN-CVE-2025-61772
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 27 moreShow less
OSVGHSA-wpv5-97wm-hp9c 7.5

Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

Summary

Rack::Multipart::Parser can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (CRLFCRLF). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS).

Details

While reading multipart headers, the parser waits for CRLFCRLF using:

@sbuf.scan_until(/(.*?\r\n)\r\n/m)

If the terminator never appears, it continues appending data (@sbuf.concat(content)) indefinitely. There is no limit on accumulated header bytes, so a single malformed part can consume memory proportional to the request body size.

Impact

Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected.

Mitigation

  • Upgrade to a patched Rack version that caps per-part header size (e.g., 64 KiB).
  • Until then, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx client_max_body_size).
Record
GHSA-wpv5-97wm-hp9c
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVRHSA-2025:19512 7.5

Red Hat Security Advisory: pcs security update

Record
RHSA-2025:19512
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:19513 7.5

Red Hat Security Advisory: pcs security update

Record
RHSA-2025:19513
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:19647 7.5

Red Hat Security Advisory: pcs security update

Record
RHSA-2025:19647
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:19719 7.5

Red Hat Security Advisory: pcs security update

Record
RHSA-2025:19719
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:19733 7.5

Red Hat Security Advisory: pcs security update

Record
RHSA-2025:19733
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:19734 7.5

Red Hat Security Advisory: pcs security update

Record
RHSA-2025:19734
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:19736 7.5

Red Hat Security Advisory: pcs security update

Record
RHSA-2025:19736
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:19800 7.5

Red Hat Security Advisory: pcs security update

Record
RHSA-2025:19800
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:19948 7.5

Red Hat Security Advisory: pcs security update

Record
RHSA-2025:19948
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:20962 7.5

Red Hat Security Advisory: pcs security update

Record
RHSA-2025:20962
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:21036 7.5

Red Hat Security Advisory: pcs security update

Record
RHSA-2025:21036
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2025:19512 7.5

Important: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

  • rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830)

  • rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)

  • rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)

  • rack: Rack memory exhaustion denial of service (CVE-2025-61772)

  • rubygem-rack: Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:19512
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2025:19719 7.5

Important: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

  • rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830)

  • rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)

  • rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)

  • rack: Rack memory exhaustion denial of service (CVE-2025-61772)

  • rubygem-rack: Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:19719
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2025:20962 7.5

Important: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

  • rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830)

  • rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)

  • rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)

  • rack: Rack memory exhaustion denial of service (CVE-2025-61772)

  • rubygem-rack: Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:20962
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-61772 7.5

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, Rack::Multipart::Parser can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (CRLFCRLF). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected. Versions 2.2.19, 3.1.17, and 3.2.2 cap per-part header size (e.g., 64 KiB). As a workaround, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx client_max_body_size).

Record
UBUNTU-CVE-2025-61772
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2025:19719 No score

Important: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

  • rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830)
  • rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
  • rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
  • rack: Rack memory exhaustion denial of service (CVE-2025-61772)
  • rubygem-rack: Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:19719
Updated
2026-11-02
OSVALSA-2025:20962 No score

Important: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

  • rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830)
  • rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
  • rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
  • rack: Rack memory exhaustion denial of service (CVE-2025-61772)
  • rubygem-rack: Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:20962
Updated
2026-11-02
OSVALSA-2025:21036 No score

Important: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

  • rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830)
  • rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
  • rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
  • rack: Rack memory exhaustion denial of service (CVE-2025-61772)
  • rubygem-rack: Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:21036
Updated
2026-11-02
OSVCLSA-2026-1790243751 No score

pcs: Fix of 10 CVEs

  • CVE-2025-46727: unbounded query parsing in bundled rack; a body of repeated keys was parsed in full, exhausting memory. Capped by rack's new query bytesize and parameter-count limits, which pcsd turns into an HTTP 400
  • CVE-2025-59830: the same unbounded query parse reached through ';' separated query strings, which rack's parameter counter did not count
  • CVE-2025-61770: multipart parsing in bundled rack read the whole request body searching for a boundary that never arrived
  • CVE-2025-61771: multipart parsing in bundled rack retained an unbounded non-file field in memory
  • CVE-2025-61772: multipart mime part headers in bundled rack were read with no size limit
  • CVE-2025-61919: Rack::Request#POST read the entire request body before any limit applied, so a 64 MB body was fully buffered
  • CVE-2024-49761: quadratic regular expression in bundled rexml BaseParser#unnormalize; a long run of zeros in a hex character reference made the parser hang
  • CVE-2024-52804: quadratic cookie unquoting in bundled tornado _unquote_cookie, which rescanned the value from each escape
  • CVE-2025-47287: malformed multipart/form-data in bundled tornado logged a warning per bad part instead of rejecting the request, flooding the log
  • CVE-2026-31958: unbounded part count and part header size in bundled tornado multipart parsing
  • Stop forwarding client HTTP headers from the Tornado front end to the Ruby part of pcsd, which only ever needed the cookie and the content type
Record
CLSA-2026-1790243751
Updated
2026-11-02
OSVCLSA-2026-1790610331 No score

pcs: Fix of 10 CVEs

  • Update bundled rubygem rack to 2.2.20
  • CVE-2024-25126: fix ReDoS in Rack::MediaType content type parsing
  • CVE-2024-26141: fix response amplification from crafted Range headers
  • CVE-2024-26146: fix ReDoS in Accept and Forwarded header parsing
  • CVE-2025-46727: fix unbounded parameter count in Rack::QueryParser
  • CVE-2025-59830: fix params_limit bypass via semicolon-separated parameters
  • CVE-2025-61770: fix unbounded multipart preamble buffering
  • CVE-2025-61771: fix unbounded buffering of non-file multipart fields
  • CVE-2025-61772: fix unbounded multipart part header buffering
  • CVE-2025-61919: fix unbounded form body read in Rack::Request#POST
  • Handle Rack::QueryParser::QueryLimitError in pcsd, returning 400 instead of 500
  • CVE-2026-31958: cap multipart part count and part header size in bundled tornado
  • Disable multipart request parsing in pcsd, which does not use it
  • Drop i686 from ExclusiveArch: the bundled web UI needs npm at build time and npm has no i686 build, so the i686 buildroot cannot be created
Record
CLSA-2026-1790610331
Updated
2026-11-02
OSVCLSA-2026-1790610419 No score

pcs: Fix of 10 CVEs

  • Update bundled rubygem rack to 2.2.20
  • CVE-2024-25126: fix ReDoS in Rack::MediaType content type parsing
  • CVE-2024-26141: fix response amplification from crafted Range headers
  • CVE-2024-26146: fix ReDoS in Accept and Forwarded header parsing
  • CVE-2025-46727: fix unbounded parameter count in Rack::QueryParser
  • CVE-2025-59830: fix params_limit bypass via semicolon-separated parameters
  • CVE-2025-61770: fix unbounded multipart preamble buffering
  • CVE-2025-61771: fix unbounded buffering of non-file multipart fields
  • CVE-2025-61772: fix unbounded multipart part header buffering
  • CVE-2025-61919: fix unbounded form body read in Rack::Request#POST
  • Handle Rack::QueryParser::QueryLimitError in pcsd, returning 400 instead of 500
  • CVE-2026-31958: cap multipart part count and part header size in bundled tornado
  • Disable multipart request parsing in pcsd, which does not use it
  • Drop i686 from ExclusiveArch: the bundled web UI needs npm at build time and npm has no i686 build, so the i686 buildroot cannot be created
Record
CLSA-2026-1790610419
Updated
2026-11-02
OSVCLSA-2026-1792125039 No score

pcs: Fix of 7 CVEs

  • CVE-2025-61772: fix unbounded multipart part header buffering
  • CVE-2025-59830: fix params_limit bypass via semicolon-separated parameters
Record
CLSA-2026-1792125039
Updated
2026-11-02
OSVCLSA-2026-1792688250 No score

pcs: Fix of 4 CVEs

  • Fix CVE-2025-46727: limit number and bytesize of query parameters in bundled rubygem rack
  • Fix CVE-2025-61919: bound the read of urlencoded request bodies in bundled rubygem rack
  • Fix CVE-2025-61771: limit multipart data retained in memory in bundled rubygem rack
  • Fix CVE-2025-61772: limit the multipart part header size in bundled rubygem rack
  • Skip the pcs tests that need pacemaker >= 1.1.23 when the build root has an older one (CloudLinux 7)
Record
CLSA-2026-1792688250
Updated
2026-11-02
OSVMGASA-2025-0334 No score

Updated ruby-rack packages fix security vulnerabilities

Unbounded-Parameter DoS in Rack::QueryParser. (CVE-2025-46727) ReDoS Vulnerability in Rack::Multipart handle_mime_head. (CVE-2025-49007) Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters. (CVE-2025-59830) Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion). (CVE-2025-61770) Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion). (CVE-2025-61771) Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion). (CVE-2025-61772) Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing. (CVE-2025-61919) Rack has Possible Information Disclosure Vulnerability. (CVE-2025-61780)

Record
MGASA-2025-0334
Updated
2026-11-02
OSVopenSUSE-SU-2025:15621-1 No score

ruby3.4-rubygem-rack-2.2-2.2.19-1.1 on GA media

These are all security issues fixed in the ruby3.4-rubygem-rack-2.2-2.2.19-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15621-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10286-1 No score

ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media

These are all security issues fixed in the ruby4.0-rubygem-rack-2.2-2.2.22-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10286-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rack
RubyGems
 before 2.2.19
2.2.19
rack
RubyGems
 3.1 up to 3.1.17
3.1.17
rack
RubyGems
 3.2 up to 3.2.2
3.2.2
pcs
AlmaLinux:8
From an advisory covering 5 CVEs
 before 0.10.18-2.el8_10.7.alma.1
0.10.18-2.el8_10.7.alma.1
pcs-snmp
AlmaLinux:8
From an advisory covering 5 CVEs
 before 0.10.18-2.el8_10.7.alma.1
0.10.18-2.el8_10.7.alma.1
pcs
AlmaLinux:9
From an advisory covering 5 CVEs
 before 0.11.10-1.el9_7.1
0.11.10-1.el9_7.1
pcs-snmp
AlmaLinux:9
From an advisory covering 5 CVEs
 before 0.11.10-1.el9_7.1
0.11.10-1.el9_7.1
cockpit-ha-cluster
AlmaLinux:10
From an advisory covering 5 CVEs
 before 0.12.1-1.el10_1.1
0.12.1-1.el10_1.1
pcs
TuxCare:CentOS-Stream:8
From an advisory covering 10 CVEs
 before 0.10.18-2.el8.tuxcare.els1
0.10.18-2.el8.tuxcare.els1
pcs-snmp
TuxCare:CentOS-Stream:8
From an advisory covering 10 CVEs
 before 0.10.18-2.el8.tuxcare.els1
0.10.18-2.el8.tuxcare.els1
Show 72 moreShow less
Affected packages
PackageAffectedFixed
pcs
TuxCare:CentOS:8.4
From an advisory covering 10 CVEs
 before 0.10.8-1.el8.tuxcare.els1
0.10.8-1.el8.tuxcare.els1
pcs-snmp
TuxCare:CentOS:8.4
From an advisory covering 10 CVEs
 before 0.10.8-1.el8.tuxcare.els1
0.10.8-1.el8.tuxcare.els1
pcs
TuxCare:CentOS:8.5
From an advisory covering 10 CVEs
 before 0.10.8-1.el8.tuxcare.els1
0.10.8-1.el8.tuxcare.els1
pcs-snmp
TuxCare:CentOS:8.5
From an advisory covering 10 CVEs
 before 0.10.8-1.el8.tuxcare.els1
0.10.8-1.el8.tuxcare.els1
pcs
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 0.11.4-7.el9_2.tuxcare.els4
0.11.4-7.el9_2.tuxcare.els4
pcs-snmp
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 0.11.4-7.el9_2.tuxcare.els4
0.11.4-7.el9_2.tuxcare.els4
pcs
TuxCare:OracleLinux:7
From an advisory covering 4 CVEs
 before 0.9.169-3.0.1.el7_9.3.tuxcare.els1
0.9.169-3.0.1.el7_9.3.tuxcare.els1
pcs-snmp
TuxCare:OracleLinux:7
From an advisory covering 4 CVEs
 before 0.9.169-3.0.1.el7_9.3.tuxcare.els1
0.9.169-3.0.1.el7_9.3.tuxcare.els1
ruby-rack
Debian:12
 before 2.2.20-0+deb12u1, plus listed versions
2.2.13-1~deb12u12.2.6.4-12.2.6.4-1+deb12u12.2.7-12.2.7-1.1
2.2.20-0+deb12u1
ruby-rack
Debian:13
 before 3.1.18-1~deb13u1, plus listed versions
3.1.16-0.1
3.1.18-1~deb13u1
ruby-rack
Debian:14
 before 3.1.18-1, plus listed versions
3.1.16-0.13.1.18-1~deb13u1
3.1.18-1
ruby-rack
Debian:11
From an advisory covering 8 CVEs
 before 2.1.4-3+deb11u4, plus listed versions
2.1.4-32.1.4-3+deb11u12.1.4-3+deb11u22.1.4-3+deb11u3
2.1.4-3+deb11u4
ruby-rack
Debian:12
From an advisory covering 5 CVEs
 before 2.2.20-0+deb12u1, plus listed versions
2.2.13-1~deb12u12.2.6.4-12.2.6.4-1+deb12u12.2.7-12.2.7-1.1
2.2.20-0+deb12u1
ruby-rack
Debian:13
From an advisory covering 5 CVEs
 before 3.1.18-1~deb13u1, plus listed versions
3.1.16-0.1
3.1.18-1~deb13u1
rack
RubyGems
 before 2.2.19, plus listed versions
0.1.00.2.00.3.00.4.00.9.0
Show 45 moreShow less
0.9.11.0.01.0.11.1.01.1.11.1.1.pre1.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.21.2.31.2.41.2.51.2.61.2.71.2.81.3.01.3.0.beta1.3.0.beta21.3.11.3.101.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.91.4.01.4.11.4.21.4.31.4.41.4.51.4.61.4.71.5.01.5.0.beta.11.5.0.beta.21.5.1
2.2.19
rack
RubyGems
 3.1 up to 3.1.17, plus listed versions
3.1.03.1.13.1.103.1.113.1.12
Show 12 moreShow less
3.1.133.1.143.1.153.1.163.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.9
3.1.17
rack
RubyGems
 3.2 up to 3.2.2, plus listed versions
3.2.03.2.1
3.2.2
ruby-rack
Mageia:9
From an advisory covering 8 CVEs
 before 2.2.21-1.mga9
2.2.21-1.mga9
pcs
Red Hat:enterprise_linux:9::highavailability
From an advisory covering 5 CVEs
 before 0:0.11.9-2.el9_6.2
0:0.11.9-2.el9_6.2
pcs-snmp
Red Hat:enterprise_linux:9::highavailability
From an advisory covering 5 CVEs
 before 0:0.11.9-2.el9_6.2
0:0.11.9-2.el9_6.2
pcs
Red Hat:enterprise_linux:9::resilientstorage
From an advisory covering 5 CVEs
 before 0:0.11.9-2.el9_6.2
0:0.11.9-2.el9_6.2
pcs-snmp
Red Hat:enterprise_linux:9::resilientstorage
From an advisory covering 5 CVEs
 before 0:0.11.9-2.el9_6.2
0:0.11.9-2.el9_6.2
cockpit-ha-cluster
Red Hat:enterprise_linux:10.0
From an advisory covering 5 CVEs
 before 0:0.12.0-3.el10_0.3
0:0.12.0-3.el10_0.3
pcs
Red Hat:enterprise_linux:10.0
From an advisory covering 5 CVEs
 before 0:0.12.0-3.el10_0.3
0:0.12.0-3.el10_0.3
pcs-snmp
Red Hat:enterprise_linux:10.0
From an advisory covering 5 CVEs
 before 0:0.12.0-3.el10_0.3
0:0.12.0-3.el10_0.3
pcs
Red Hat:rhel_e4s:8.8::highavailability
From an advisory covering 5 CVEs
 before 0:0.10.15-4.el8_8.9
0:0.10.15-4.el8_8.9
pcs-snmp
Red Hat:rhel_e4s:8.8::highavailability
From an advisory covering 5 CVEs
 before 0:0.10.15-4.el8_8.9
0:0.10.15-4.el8_8.9
pcs
Red Hat:rhel_tus:8.8::highavailability
From an advisory covering 5 CVEs
 before 0:0.10.15-4.el8_8.9
0:0.10.15-4.el8_8.9
pcs-snmp
Red Hat:rhel_tus:8.8::highavailability
From an advisory covering 5 CVEs
 before 0:0.10.15-4.el8_8.9
0:0.10.15-4.el8_8.9
pcs
Red Hat:enterprise_linux:8::highavailability
From an advisory covering 5 CVEs
 before 0:0.10.18-2.el8_10.7
0:0.10.18-2.el8_10.7
pcs-snmp
Red Hat:enterprise_linux:8::highavailability
From an advisory covering 5 CVEs
 before 0:0.10.18-2.el8_10.7
0:0.10.18-2.el8_10.7
pcs
Red Hat:enterprise_linux:8::resilientstorage
From an advisory covering 5 CVEs
 before 0:0.10.18-2.el8_10.7
0:0.10.18-2.el8_10.7
pcs-snmp
Red Hat:enterprise_linux:8::resilientstorage
From an advisory covering 5 CVEs
 before 0:0.10.18-2.el8_10.7
0:0.10.18-2.el8_10.7
pcs
Red Hat:rhel_e4s:9.2::highavailability
From an advisory covering 4 CVEs
 before 0:0.11.4-7.el9_2.6
0:0.11.4-7.el9_2.6
pcs-snmp
Red Hat:rhel_e4s:9.2::highavailability
From an advisory covering 4 CVEs
 before 0:0.11.4-7.el9_2.6
0:0.11.4-7.el9_2.6
pcs
Red Hat:rhel_e4s:9.2::resilientstorage
From an advisory covering 4 CVEs
 before 0:0.11.4-7.el9_2.6
0:0.11.4-7.el9_2.6
pcs-snmp
Red Hat:rhel_e4s:9.2::resilientstorage
From an advisory covering 4 CVEs
 before 0:0.11.4-7.el9_2.6
0:0.11.4-7.el9_2.6
pcs
Red Hat:rhel_e4s:8.6::highavailability
From an advisory covering 5 CVEs
 before 0:0.10.12-6.el8_6.10
0:0.10.12-6.el8_6.10
pcs-snmp
Red Hat:rhel_e4s:8.6::highavailability
From an advisory covering 5 CVEs
 before 0:0.10.12-6.el8_6.10
0:0.10.12-6.el8_6.10
pcs
Red Hat:rhel_tus:8.6::highavailability
From an advisory covering 5 CVEs
 before 0:0.10.12-6.el8_6.10
0:0.10.12-6.el8_6.10
pcs-snmp
Red Hat:rhel_tus:8.6::highavailability
From an advisory covering 5 CVEs
 before 0:0.10.12-6.el8_6.10
0:0.10.12-6.el8_6.10
pcs
Red Hat:rhel_eus:9.4::highavailability
From an advisory covering 4 CVEs
 before 0:0.11.7-2.el9_4.5
0:0.11.7-2.el9_4.5
pcs-snmp
Red Hat:rhel_eus:9.4::highavailability
From an advisory covering 4 CVEs
 before 0:0.11.7-2.el9_4.5
0:0.11.7-2.el9_4.5
pcs
Red Hat:rhel_eus:9.4::resilientstorage
From an advisory covering 4 CVEs
 before 0:0.11.7-2.el9_4.5
0:0.11.7-2.el9_4.5
pcs-snmp
Red Hat:rhel_eus:9.4::resilientstorage
From an advisory covering 4 CVEs
 before 0:0.11.7-2.el9_4.5
0:0.11.7-2.el9_4.5
pcs
Red Hat:rhel_e4s:9.0::highavailability
From an advisory covering 5 CVEs
 before 0:0.11.1-10.el9_0.9
0:0.11.1-10.el9_0.9
pcs-snmp
Red Hat:rhel_e4s:9.0::highavailability
From an advisory covering 5 CVEs
 before 0:0.11.1-10.el9_0.9
0:0.11.1-10.el9_0.9
pcs
Red Hat:rhel_e4s:9.0::resilientstorage
From an advisory covering 5 CVEs
 before 0:0.11.1-10.el9_0.9
0:0.11.1-10.el9_0.9
pcs-snmp
Red Hat:rhel_e4s:9.0::resilientstorage
From an advisory covering 5 CVEs
 before 0:0.11.1-10.el9_0.9
0:0.11.1-10.el9_0.9
pcs
Red Hat:rhel_aus:8.4::highavailability
From an advisory covering 5 CVEs
 before 0:0.10.8-1.el8_4.8
0:0.10.8-1.el8_4.8
pcs-snmp
Red Hat:rhel_aus:8.4::highavailability
From an advisory covering 5 CVEs
 before 0:0.10.8-1.el8_4.8
0:0.10.8-1.el8_4.8
pcs
Red Hat:rhel_eus_long_life:8.4::highavailability
From an advisory covering 5 CVEs
 before 0:0.10.8-1.el8_4.8
0:0.10.8-1.el8_4.8
pcs-snmp
Red Hat:rhel_eus_long_life:8.4::highavailability
From an advisory covering 5 CVEs
 before 0:0.10.8-1.el8_4.8
0:0.10.8-1.el8_4.8
pcs
Red Hat:enterprise_linux:9::highavailability
From an advisory covering 5 CVEs
 before 0:0.11.10-1.el9_7.1
0:0.11.10-1.el9_7.1
pcs-snmp
Red Hat:enterprise_linux:9::highavailability
From an advisory covering 5 CVEs
 before 0:0.11.10-1.el9_7.1
0:0.11.10-1.el9_7.1
pcs
Red Hat:enterprise_linux:9::resilientstorage
From an advisory covering 5 CVEs
 before 0:0.11.10-1.el9_7.1
0:0.11.10-1.el9_7.1
pcs-snmp
Red Hat:enterprise_linux:9::resilientstorage
From an advisory covering 5 CVEs
 before 0:0.11.10-1.el9_7.1
0:0.11.10-1.el9_7.1
cockpit-ha-cluster
Red Hat:enterprise_linux:10.1
From an advisory covering 5 CVEs
 before 0:0.12.1-1.el10_1.1
0:0.12.1-1.el10_1.1
pcs
Red Hat:enterprise_linux:10.1
From an advisory covering 5 CVEs
 before 0:0.12.1-1.el10_1.1
0:0.12.1-1.el10_1.1
pcs-snmp
Red Hat:enterprise_linux:10.1
From an advisory covering 5 CVEs
 before 0:0.12.1-1.el10_1.1
0:0.12.1-1.el10_1.1
pcs
Rocky Linux:9
From an advisory covering 5 CVEs
 before 0:0.11.9-2.el9_6.2
0:0.11.9-2.el9_6.2
pcs
Rocky Linux:8
From an advisory covering 5 CVEs
 before 0:0.10.18-2.el8_10.7
0:0.10.18-2.el8_10.7
pcs
Rocky Linux:9
From an advisory covering 5 CVEs
 before 0:0.11.10-1.el9_7.1
0:0.11.10-1.el9_7.1
ruby-rack
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.5.2-11.5.2-1ubuntu0.1~esm11.5.2-3+deb8u3ubuntu1~esm21.5.2-3+deb8u3ubuntu1~esm31.5.2-3+deb8u3ubuntu1~esm4
Show 6 moreShow less
1.5.2-3+deb8u3ubuntu1~esm61.5.2-3+deb8u3ubuntu1~esm71.5.2-3+deb8u3ubuntu1~esm81.5.2-3+deb8u3ubuntu1~esm91.5.2-3+deb8u3ubuntu1~esm101.5.2-3+deb8u3ubuntu1~esm11
 None known
ruby-rack
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.5.2-41.6.4-21.6.4-31.6.4-3ubuntu0.11.6.4-3ubuntu0.2
Show 9 moreShow less
1.6.4-3ubuntu0.2+esm11.6.4-3ubuntu0.2+esm21.6.4-3ubuntu0.2+esm41.6.4-3ubuntu0.2+esm51.6.4-3ubuntu0.2+esm61.6.4-3ubuntu0.2+esm71.6.4-3ubuntu0.2+esm81.6.4-3ubuntu0.2+esm91.6.4-3ubuntu0.2+esm10
 None known
ruby-rack
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.6.4-41.6.4-4ubuntu0.11.6.4-4ubuntu0.21.6.4-4ubuntu0.2+esm11.6.4-4ubuntu0.2+esm2
Show 7 moreShow less
1.6.4-4ubuntu0.2+esm41.6.4-4ubuntu0.2+esm51.6.4-4ubuntu0.2+esm61.6.4-4ubuntu0.2+esm71.6.4-4ubuntu0.2+esm81.6.4-4ubuntu0.2+esm91.6.4-4ubuntu0.2+esm10
 None known
ruby-rack
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.0.6-32.0.7-22.0.7-2ubuntu0.12.0.7-2ubuntu0.1+esm12.0.7-2ubuntu0.1+esm2
Show 8 moreShow less
2.0.7-2ubuntu0.1+esm32.0.7-2ubuntu0.1+esm42.0.7-2ubuntu0.1+esm52.0.7-2ubuntu0.1+esm62.0.7-2ubuntu0.1+esm72.0.7-2ubuntu0.1+esm82.0.7-2ubuntu0.1+esm92.0.7-2ubuntu0.1+esm10
 None known
ruby-rack
Ubuntu:22.04:LTS
 before 2.1.4-5ubuntu1.2, plus listed versions
2.1.4-32.1.4-42.1.4-52.1.4-5ubuntu12.1.4-5ubuntu1.1
2.1.4-5ubuntu1.2
ruby-rack
Ubuntu:24.04:LTS
 before 2.2.7-1ubuntu0.5, plus listed versions
2.2.4-32.2.7-12.2.7-1ubuntu0.12.2.7-1ubuntu0.22.2.7-1ubuntu0.32.2.7-1ubuntu0.4
2.2.7-1ubuntu0.5
ruby-rack
Ubuntu:25.10
 before 3.1.16-0.1ubuntu0.1, plus listed versions
2.2.7-1.13.1.16-0.1
3.1.16-0.1ubuntu0.1
rubygem-rack-2.2
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 2.2.19-1.1
2.2.19-1.1
rubygem-rack-2.2
openSUSE:Tumbleweed
From an advisory covering 27 CVEs
 before 2.2.22-1.1
2.2.22-1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-61772 is a high vulnerability (CVSS 7.5) in Rack, published October 7, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.93%, the 60th percentile. Fixed in rack 2.2.19.

References

Show 111 moreShow less
This page doesn't list everything

Left out here: 69 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open