Skip to content
OpenAdvisories
Medium WID-SEC-2025-2482 5 CVEs

Red Hat Enterprise Linux: Mehrere Schwachstellen ermöglichen Denial of Service

Published Nov 3, 2025 · Updated Jan 14, 2026 · Revision 12 · de-DE

Vendor: Debian Vendor: IBM Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: Ubuntu Product: Enterprise Linux Product: License Metric Tool Product: Linux Product: Linux Product: Linux Product: Rocky Linux Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.

Vulnerabilities 5

  • High 7.5
    CVE-2025-59830

    Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters

    Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter …

    rack rack rack ruby-rack Debian Ubuntu Wolfi RubyGems
  • High 7.5
    CVE-2025-61770

    Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)

    Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` buffers the entire multipart preamble (bytes before the first boundary) in memory without any size limit. A client can send a large preamble…

    rack rack rack ruby-rack Debian Ubuntu Wolfi RubyGems
  • High 7.5
    CVE-2025-61771

    Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

    Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, ``Rack::Multipart::Parser` stores non-file form fields (parts without a `filename`) entirely in memory as Ruby `String` objects. A single large text field in a multip…

    rack rack rack ruby-rack Debian Ubuntu Wolfi RubyGems
  • High 7.5
    CVE-2025-61772

    Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

    Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (`CRLFCRLF`). The parser ke…

    rack rack rack ruby-rack Debian Ubuntu Wolfi RubyGems
  • High 7.5
    CVE-2025-61919

    Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing

    Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, `Rack::Request#POST` reads the entire request body into memory for `Content-Type: application/x-www-form-urlencoded`, calling `rack.input.read(nil)` without enforcing a …

    rack rack kube-fluentd-operator rack Debian Ubuntu Wolfi RubyGems

Revision history

  1. #12

    Neue Updates von Ubuntu aufgenommen

  2. #11

    Neue Updates von IBM aufgenommen

  3. #10

    Neue Updates von Oracle Linux aufgenommen

  4. #9

    Neue Updates von Oracle Linux aufgenommen

  5. #8

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  6. #7

    Neue Updates von Red Hat aufgenommen

  7. #6

    Neue Updates von Red Hat aufgenommen

  8. #5

    Neue Updates von Oracle Linux und Red Hat aufgenommen

  9. #4

    Neue Updates von Oracle Linux aufgenommen

  10. #3

    Neue Updates von Red Hat und Rocky Enterprise Software Foundation aufgenommen

  11. #2

    Neue Updates von Red Hat aufgenommen

  12. #1

    Initiale Fassung

References