{"id":"CVE-2025-61921","aliases":["DEBIAN-CVE-2025-61921","EUVD-2025-33767","GHSA-mr3q-g2mv-mr4q","UBUNTU-CVE-2025-61921","USN-8624-1"],"status":"published","title":"Sinatra has ReDoS vulnerability in ETag header value generation","description":"Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.","severity":{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00495,"percentile":0.42994,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333","CWE-400"],"published":"2025-10-10T19:28:10Z","modified":"2026-10-28T02:30:22Z","fixes":[{"ecosystem":"RubyGems","package":"sinatra","fixed_in":["4.2.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-sinatra","fixed_in":["3.0.5-3+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-sinatra","fixed_in":["4.2.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-sinatra","fixed_in":["1.4.7-3ubuntu0.1~esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-sinatra","fixed_in":["1.4.8-1ubuntu0.1~esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-sinatra","fixed_in":["2.0.8.1-2+deb11u1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"ruby-sinatra","fixed_in":["4.2.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-sinatra","fixed_in":["2.0.8.1-1ubuntu0.1~esm3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-3+deb12u1"}]}],"versions":["3.0.5-3"]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1-5","4.1.1-6","4.2.1-1","4.2.1-2","4.2.1-3","4.2.1-4","4.2.1-5"]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1"}]}],"versions":["4.1.1-5","4.1.1-6"]},{"source":"osv","ecosystem":"RubyGems","package":"sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0"}]}],"versions":["0.1.0","0.1.5","0.1.6","0.1.7","0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.3.2","0.3.3","0.9.0","0.9.0.1","0.9.0.2","0.9.0.3","0.9.0.4","0.9.0.5","0.9.1","0.9.1.1","0.9.2","0.9.4","0.9.5","0.9.6","1.0","1.0.a","1.0.b","1.1.0","1.1.2","1.1.3","1.1.4","1.1.a","1.1.b","1.2.0","1.2.0.a","1.2.0.c","1.2.0.d","1.2.1","1.2.2","1.2.3","1.2.6","1.2.7","1.2.8","1.2.9","1.3.0","1.3.0.a","1.3.0.b","1.3.0.c","1.3.0.d","1.3.0.e","1.3.0.f","1.3.0.g","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.4.0","1.4.0.a","1.4.0.b","1.4.0.c","1.4.0.d","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","2.0.0","2.0.0.beta1","2.0.0.beta2","2.0.0.rc1","2.0.0.rc2","2.0.0.rc5","2.0.0.rc6","2.0.1","2.0.1.rc1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.8.1","2.1.0","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.1.0","3.2.0","4.0.0","4.0.1","4.1.0","4.1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-3ubuntu0.1~esm3"}]}],"versions":["1.4.6-2","1.4.7-3","1.4.7-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1ubuntu0.1~esm3"}]}],"versions":["1.4.7-5","1.4.8-1","1.4.8-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8.1-2+deb11u1ubuntu0.1~esm1"}]}],"versions":["2.0.8.1-2","2.0.8.1-2+deb11u1build0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1"}]}],"versions":["4.1.1-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-3ubuntu0.1~esm3"}]}],"versions":["1.4.6-2","1.4.7-3","1.4.7-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1ubuntu0.1~esm3"}]}],"versions":["1.4.7-5","1.4.8-1","1.4.8-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8.1-1ubuntu0.1~esm3"}]}],"versions":["2.0.5-4ubuntu1","2.0.8.1-1","2.0.8.1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8.1-2+deb11u1ubuntu0.1~esm1"}]}],"versions":["2.0.8.1-2","2.0.8.1-2+deb11u1build0.22.04.1"]}],"products":[{"vendor":"sinatra","product":"sinatra"},{"vendor":"sinatrarb","product":"sinatra"}],"references":[{"url":"https://github.com/sinatra/sinatra/security/advisories/GHSA-mr3q-g2mv-mr4q","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/sinatra/sinatra/issues/2120","tags":["x_refsource_MISC","Issue Tracking","report","web"]},{"url":"https://github.com/sinatra/sinatra/pull/1823","tags":["x_refsource_MISC","Exploit","Patch","fix","web"]},{"url":"https://github.com/sinatra/sinatra/pull/2121","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://bugs.ruby-lang.org/issues/19104","tags":["x_refsource_MISC","Issue Tracking","web"]},{"url":"https://github.com/sinatra/sinatra/commit/3fe8c38dc405586f7ad8f2ac748aa53e9c3615bd","tags":["web"]},{"url":"https://github.com/sinatra/sinatra/commit/8ff496bd4877520599e1479d6efead39304edceb","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61921","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sinatra/CVE-2025-61921.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mr3q-g2mv-mr4q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61921.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-61921","tags":["advisory"]},{"url":"https://github.com/sinatra/sinatra","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-61921","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-61921","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8624-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-61921","title":"Sinatra has ReDoS vulnerability in ETag header value generation","description":"Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.","status":"published","published":"2025-10-10T19:28:10.688Z","modified":"2025-10-10T20:54:47.627Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:32:44.763463Z"}],"euvd":[{"id":"EUVD-2025-33767","description":"Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.","status":"published","published":"2025-10-10T19:28:10Z","modified":"2025-10-10T20:54:47Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"}],"updated_at":"2026-11-02T20:31:33.532032Z"}],"ghsa":[{"id":"GHSA-mr3q-g2mv-mr4q","title":"Sinatra is vulnerable to ReDoS through ETag header value generation","description":"### Summary\n\nThere is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response and you are using Ruby \u003c 3.2.\n\n### Details\n\nCarefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted if they are using Ruby below version 3.2.\n\n### Resources\n\n* https://github.com/sinatra/sinatra/issues/2120 (report)\n* https://github.com/sinatra/sinatra/pull/2121 (fix)\n* https://github.com/sinatra/sinatra/pull/1823 (older ReDoS vulnerability)\n* https://bugs.ruby-lang.org/issues/19104 (fix in Ruby \u003e= 3.2)","status":"published","published":"2025-10-10T20:28:47Z","modified":"2025-10-13T15:46:29Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-400","CWE-1333"],"updated_at":"2026-11-02T14:39:00.807341Z"}],"nvd":[{"id":"CVE-2025-61921","description":"Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.","status":"published","published":"2025-10-10T20:15:38.067Z","modified":"2026-10-19T16:10:00.26Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:11:36.851295Z"}],"osv":[{"id":"CVE-2025-61921","title":"Sinatra has ReDoS vulnerability in ETag header value generation","description":"Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.","status":"published","published":"2025-10-10T19:28:10.688Z","modified":"2026-10-28T02:30:22.039876149Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:44:51.516975Z"},{"id":"DEBIAN-CVE-2025-61921","description":"Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.","status":"published","published":"2025-10-10T20:15:38.067Z","modified":"2026-10-23T17:47:32.516229901Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"GHSA-mr3q-g2mv-mr4q","title":"Sinatra is vulnerable to ReDoS through ETag header value generation","description":"### Summary\n\nThere is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response and you are using Ruby \u003c 3.2.\n\n### Details\n\nCarefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted if they are using Ruby below version 3.2.\n\n### Resources\n\n* https://github.com/sinatra/sinatra/issues/2120 (report)\n* https://github.com/sinatra/sinatra/pull/2121 (fix)\n* https://github.com/sinatra/sinatra/pull/1823 (older ReDoS vulnerability)\n* https://bugs.ruby-lang.org/issues/19104 (fix in Ruby \u003e= 3.2)","status":"published","published":"2025-10-10T20:28:47Z","modified":"2026-09-10T03:50:30.082629594Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"}],"cwes":["CWE-1333","CWE-400"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"UBUNTU-CVE-2025-61921","description":"Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.","status":"published","published":"2025-10-10T20:15:00Z","modified":"2026-07-31T01:55:18.498130691Z","cvss":[{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","level":"low"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"USN-8624-1","title":"ruby-sinatra vulnerability","description":"It was discovered that Sinatra did not properly handle header parsing,\ncausing ETag generation to hang when given specific input. A remote\nattacker could possibly use this issue to cause a denial of service.","status":"published","published":"2026-07-29T19:09:19Z","modified":"2026-07-31T02:00:30.205189679Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}