CVE-2025-59830

Summary

Rack::QueryParser in version < 2.2.18 enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended.

Details

The issue arises because Rack::QueryParser#check_query_string counts only & characters when determining the number of parameters, but the default separator regex DEFAULT_SEP = /[&;] */n splits on both & and ;. This mismatch means that queries using ; separators were not included in the parameter count, allowing params_limit to be bypassed.

Other safeguards (bytesize_limit and key_space_limit) still applied, but did not prevent this particular bypass.

Impact

Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector.

Rack::Request, the primary entry point for typical Rack applications, uses QueryParser in a safe way and does not appear vulnerable by default. As such, the severity is considered low, with the impact limited to edge cases where QueryParser is used directly.

Mitigation

• Upgrade to a patched version of Rack where both & and ; are counted consistently toward params_limit.
• If upgrading is not immediately possible, configure QueryParser with an explicit delimiter (e.g., &) to avoid the mismatch.
• As a general precaution, enforce query string and request size limits at the web server or proxy layer (e.g., Nginx, Apache, or a CDN) to mitigate excessive parsing overhead.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830)

• rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)

• rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)

• rack: Rack memory exhaustion denial of service (CVE-2025-61772)

• rubygem-rack: Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830)

• rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)

• rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)

• rack: Rack memory exhaustion denial of service (CVE-2025-61772)

• rubygem-rack: Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830)

• rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)

• rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)

• rack: Rack memory exhaustion denial of service (CVE-2025-61772)

• rubygem-rack: Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830)
• rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
• rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
• rack: Rack memory exhaustion denial of service (CVE-2025-61772)
• rubygem-rack: Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830)
• rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
• rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
• rack: Rack memory exhaustion denial of service (CVE-2025-61772)
• rubygem-rack: Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

• rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830)
• rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
• rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
• rack: Rack memory exhaustion denial of service (CVE-2025-61772)
• rubygem-rack: Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2025-46727: unbounded query parsing in bundled rack; a body of repeated keys was parsed in full, exhausting memory. Capped by rack's new query bytesize and parameter-count limits, which pcsd turns into an HTTP 400
• CVE-2025-59830: the same unbounded query parse reached through ';' separated query strings, which rack's parameter counter did not count
• CVE-2025-61770: multipart parsing in bundled rack read the whole request body searching for a boundary that never arrived
• CVE-2025-61771: multipart parsing in bundled rack retained an unbounded non-file field in memory
• CVE-2025-61772: multipart mime part headers in bundled rack were read with no size limit
• CVE-2025-61919: Rack::Request#POST read the entire request body before any limit applied, so a 64 MB body was fully buffered
• CVE-2024-49761: quadratic regular expression in bundled rexml BaseParser#unnormalize; a long run of zeros in a hex character reference made the parser hang
• CVE-2024-52804: quadratic cookie unquoting in bundled tornado _unquote_cookie, which rescanned the value from each escape
• CVE-2025-47287: malformed multipart/form-data in bundled tornado logged a warning per bad part instead of rejecting the request, flooding the log
• CVE-2026-31958: unbounded part count and part header size in bundled tornado multipart parsing
• Stop forwarding client HTTP headers from the Tornado front end to the Ruby part of pcsd, which only ever needed the cookie and the content type

• Update bundled rubygem rack to 2.2.20
• CVE-2024-25126: fix ReDoS in Rack::MediaType content type parsing
• CVE-2024-26141: fix response amplification from crafted Range headers
• CVE-2024-26146: fix ReDoS in Accept and Forwarded header parsing
• CVE-2025-46727: fix unbounded parameter count in Rack::QueryParser
• CVE-2025-59830: fix params_limit bypass via semicolon-separated parameters
• CVE-2025-61770: fix unbounded multipart preamble buffering
• CVE-2025-61771: fix unbounded buffering of non-file multipart fields
• CVE-2025-61772: fix unbounded multipart part header buffering
• CVE-2025-61919: fix unbounded form body read in Rack::Request#POST
• Handle Rack::QueryParser::QueryLimitError in pcsd, returning 400 instead of 500
• CVE-2026-31958: cap multipart part count and part header size in bundled tornado
• Disable multipart request parsing in pcsd, which does not use it
• Drop i686 from ExclusiveArch: the bundled web UI needs npm at build time and npm has no i686 build, so the i686 buildroot cannot be created

• Update bundled rubygem rack to 2.2.20
• CVE-2024-25126: fix ReDoS in Rack::MediaType content type parsing
• CVE-2024-26141: fix response amplification from crafted Range headers
• CVE-2024-26146: fix ReDoS in Accept and Forwarded header parsing
• CVE-2025-46727: fix unbounded parameter count in Rack::QueryParser
• CVE-2025-59830: fix params_limit bypass via semicolon-separated parameters
• CVE-2025-61770: fix unbounded multipart preamble buffering
• CVE-2025-61771: fix unbounded buffering of non-file multipart fields
• CVE-2025-61772: fix unbounded multipart part header buffering
• CVE-2025-61919: fix unbounded form body read in Rack::Request#POST
• Handle Rack::QueryParser::QueryLimitError in pcsd, returning 400 instead of 500
• CVE-2026-31958: cap multipart part count and part header size in bundled tornado
• Disable multipart request parsing in pcsd, which does not use it
• Drop i686 from ExclusiveArch: the bundled web UI needs npm at build time and npm has no i686 build, so the i686 buildroot cannot be created

• CVE-2025-61772: fix unbounded multipart part header buffering
• CVE-2025-59830: fix params_limit bypass via semicolon-separated parameters

Unbounded-Parameter DoS in Rack::QueryParser. (CVE-2025-46727) ReDoS Vulnerability in Rack::Multipart handle_mime_head. (CVE-2025-49007) Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters. (CVE-2025-59830) Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion). (CVE-2025-61770) Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion). (CVE-2025-61771) Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion). (CVE-2025-61772) Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing. (CVE-2025-61919) Rack has Possible Information Disclosure Vulnerability. (CVE-2025-61780)

These are all security issues fixed in the ruby3.4-rubygem-rack-2.2-2.2.18-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ruby4.0-rubygem-rack-2.2-2.2.22-1.1 package on the GA media of openSUSE Tumbleweed.

It was discovered that Rack incorrectly handled limiting the amount of parameters. An attacker could possibly use this issue to bypass the params_limit value, leading to a denial of service.

It was discovered that Rack incorrectly handled certain query parameters. An attacker could possibly use this issue to cause a limited denial of service. This issue was only addressed in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2025-59830)

It was discovered that Rack did not properly handle certain multipart form data. An attacker could possibly use this issue to cause memory exhaustion, leading to a denial of service. This issue was only addressed in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-61770, CVE-2025-61772)

It was discovered that Rack did not properly handle certain form fields. An attacker could possibly use this issue to cause memory exhaustion, leading to a denial of service. This issue was only addressed in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-61771)

It was discovered that Rack did not properly handle certain headers. An attacker could possibly use this issue to bypass proxy access restrictions and obtain sensitive information. (CVE-2025-61780)

Tomoya Yamashita discovered that Rack did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause memory exhaustion, leading to a denial of service. This issue was only addressed in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-61919)