Skip to content
OpenAdvisories
High USN-7784-1 1 CVE

ruby-rack vulnerability

Published Sep 29, 2025 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Rack incorrectly handled limiting the amount of
parameters. An attacker could possibly use this issue to bypass the
params_limit value, leading to a denial of service.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 24.04 LTS 24.04:LTS ruby-rack 2.2.7-1ubuntu0.4

Vulnerabilities 1

  • High 7.5
    CVE-2025-59830

    Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters

    Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter …

    rack rack rack ruby-rack Debian Ubuntu Wolfi RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2025-59830