Rack CVE-2025-46727: Unbounded Parameter Parsing in Rack::QueryParser Causes Memory Exhaustion

Critical Vulnerability Information Vulnerability Overview Title: Unbounded parameter parsing in can lead to memory exhaustion Severity: High (7.5/10) CVE ID: CVE-2025-46727 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Required Privileges: None - User Interaction: None - Scope: Unchanged - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High Affected and Fixed Versions Affected Versions: - = 3.0, = 3.1, < 3.1.14 Fixed Versions: - 2.2.14 - 3.0.16 - 3.1.14 Vulnerability Description Summary: parses query strings and bodies, converting them into Ruby data structures, but does not impose an upper limit on the number of parameters, allowing attackers to send requests with a large number of parameters. Details: Since iterates over each &-separated key-value pair and adds them to a Hash without enforcing a limit on the total number of parameters, attackers can send a single request containing tens of thousands (or more) of parameters, consuming significant memory and CPU resources during parsing. Impact: Attackers can trigger a denial-of-service by sending specially crafted HTTP requests, leading to memory exhaustion or CPU resource exhaustion, causing the Rack server to hang or crash. This results in complete service disruption until the affected worker process is restarted. Mitigation Measures Upgrade to a Rack version that limits the number of parsed parameters. Use middleware to enforce maximum query string size or parameter count. Use a reverse proxy (e.g., Nginx) to limit request size and reject oversized query strings or bodies. Limiting request body size and query string length at the web server or CDN level is an effective mitigation.

Goal Reached Thanks to every supporter — we hit 100%!

Rack CVE-2025-46727: Unbounded Parameter Parsing in Rack::QueryParser Causes Memory Exhaustion

More from this source