{"id":"CVE-2025-26803","aliases":["BIT-passenger-2025-26803","BIT-passenger-apache-module-2025-26803","BIT-passenger-nginx-module-2025-26803","DEBIAN-CVE-2025-26803","EUVD-2025-4281","GHSA-2cj2-qqxj-5m3r","UBUNTU-CVE-2025-26803"],"status":"published","title":"Phusion Passenger denial of service","description":"The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00622,"percentile":0.50317,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-908"],"published":"2025-02-24T00:00:00Z","modified":"2026-10-28T10:45:17Z","fixes":[{"ecosystem":"RubyGems","package":"passenger","fixed_in":["6.0.26"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"passenger","fixed_in":["6.0.26"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"passenger-apache-module","fixed_in":["6.0.26"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"passenger-nginx-module","fixed_in":["6.0.26"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"passenger","fixed_in":["6.0.26+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"passenger","fixed_in":["6.0.26+ds-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.21"},{"fixed":"6.0.26"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"passenger","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.21"},{"fixed":"6.0.26"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"passenger-apache-module","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.21"},{"fixed":"6.0.26"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"passenger-nginx-module","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.21"},{"fixed":"6.0.26"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.26+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.26+ds-1"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.21"},{"fixed":"6.0.26"}]}],"versions":["6.0.21","6.0.22","6.0.23","6.0.24","6.0.25"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.24+ds-3","6.0.26+ds-1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.1+ds-1","6.1.1+ds-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"passenger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.26+ds-1.1","6.1.1+ds-1"]}],"products":[{"vendor":"phusion","product":"passenger"}],"references":[{"url":"https://www.phusionpassenger.com/support","tags":["Product","web","report"]},{"url":"https://github.com/phusion/passenger/compare/release-6.0.25...release-6.0.26","tags":["Patch","fix","web","report"]},{"url":"https://github.com/phusion/passenger/releases/tag/release-6.0.26","tags":["Patch","fix","web","report"]},{"url":"https://blog.phusion.nl/2025/02/19/passenger-6-0-26/","tags":["Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/phusion/passenger/commit/bb15591646687064ab2d578d5f9660b2a4168017","tags":["Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-26803","tags":["web","advisory"]},{"url":"https://blog.phusion.nl/2025/02/19/passenger-6-0-26","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2025-26803.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2cj2-qqxj-5m3r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/26xxx/CVE-2025-26803.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-26803","tags":["advisory"]},{"url":"https://github.com/phusion/passenger","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-26803","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-26803","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-26803","description":"The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.","status":"published","published":"2025-02-24T00:00:00Z","modified":"2025-02-24T17:00:10.319Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:32:28.250136Z"}],"euvd":[{"id":"EUVD-2025-4281","description":"The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.","status":"published","published":"2025-02-24T00:00:00Z","modified":"2025-02-24T17:00:10Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T20:53:25.075327Z"}],"ghsa":[{"id":"GHSA-2cj2-qqxj-5m3r","title":"Phusion Passenger denial of service ","description":"The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.","status":"published","published":"2025-02-24T18:32:42Z","modified":"2025-02-26T21:42:56Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:38:33.163519Z"}],"nvd":[{"id":"CVE-2025-26803","description":"The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.","status":"published","published":"2025-02-24T16:15:15.02Z","modified":"2026-06-17T09:02:27.333Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:10:51.871789Z"}],"osv":[{"id":"CVE-2025-26803","description":"The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.","status":"published","published":"2025-02-24T00:00:00Z","modified":"2026-10-28T10:45:17.091787841Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T15:44:47.386092Z"},{"id":"DEBIAN-CVE-2025-26803","description":"The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.","status":"published","published":"2025-02-24T16:15:15.02Z","modified":"2026-09-01T20:05:44.90123018Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"GHSA-2cj2-qqxj-5m3r","title":"Phusion Passenger denial of service ","description":"The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.","status":"published","published":"2025-02-24T18:32:42Z","modified":"2025-03-02T07:59:16.557898Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"UBUNTU-CVE-2025-26803","description":"The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.","status":"published","published":"2025-02-24T16:15:00Z","modified":"2026-10-17T12:56:48.989337928Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"BIT-passenger-2025-26803","description":"The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.","status":"published","published":"2025-03-02T07:16:46.292Z","modified":"2026-09-08T08:48:24.751385322Z","updated_at":"2026-11-02T15:28:34.343258Z"},{"id":"BIT-passenger-apache-module-2025-26803","description":"The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.","status":"published","published":"2025-03-02T07:16:39.193Z","modified":"2026-09-08T08:48:24.630159351Z","updated_at":"2026-11-02T15:28:34.343258Z"},{"id":"BIT-passenger-nginx-module-2025-26803","description":"The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.","status":"published","published":"2025-03-02T07:16:43.395Z","modified":"2026-09-08T08:47:36.003547243Z","updated_at":"2026-11-02T15:28:34.343258Z"}]}}