Rack CVE-2025-61919 Unbounded Read Memory Exhaustion DoS

Key Information Vulnerability Overview Vulnerability Name: Unbounded read in form parsing can lead to memory exhaustion. CVE ID: CVE-2025-61919 GHSA ID: GHSA-6xw4-3v39-52mm Publisher: ioquatix Release Time: 20 hours ago Affected Versions Affected Versions: - = 3.0, = 3.2, < 3.2.3 Fixed Versions: - 2.2.20 - 3.1.18 - 3.2.3 Severity CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Required Privileges: None - User Interaction: None - Scope: Unchanged - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High CVSS Score: 7.5 / 10 Vulnerability Description Summary: When processing requests with , reads the entire request body into memory without enforcing any length or upper bound. This can cause large request bodies to be fully buffered in process memory before parsing, potentially leading to a denial-of-service (DoS) via memory exhaustion. Details: When handling non-multipart form submissions, Rack’s request parser performs the following: Since is called without arguments, the entire request body is loaded into a Ruby string. This occurs before query parameter parsing or any enforcement. As a result, Rack applications without upstream body size limits may experience unbounded memory allocation proportional to the request size. Impact Attackers can send large bodies to exhaust process memory, causing system slowdown or termination by the operating system (OOM). The impact scales linearly with request size and concurrency. Even if parsing limits are configured, the issue occurs before those limits take effect. Mitigation Upgrade to a patched version of Rack, which enforces form parameter limits via , preventing unbounded reads of bodies. Enforce strict maximum body size limits at the proxy or web server layer (e.g., Nginx’s , Apache’s ).

Goal Reached Thanks to every supporter — we hit 100%!

Rack CVE-2025-61919 Unbounded Read Memory Exhaustion DoS

More from this source