Description
Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, `Rack::QueryParser` parses query strings and `application/x-www-form-urlencoded` bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with extremely large numbers of parameters. The vulnerability arises because `Rack::QueryParser` iterates over each `&`-separated key-value pair and adds it to a Hash without enforcing an upper bound on the total number of parameters. This allows an attacker to send a single request containing hundreds of thousands (or more) of parameters, which consumes excessive memory and CPU during parsing. An attacker can trigger denial of service by sending specifically crafted HTTP requests, which can cause memory exhaustion or pin CPU resources, stalling or crashing the Rack server. This results in full service disruption until the affected worker is restarted. Versions 2.2.14, 3.0.16, and 3.1.14 fix the issue. Some other mitigations are available. One may use middleware to enforce a maximum query string size or parameter count, or employ a reverse proxy (such as Nginx) to limit request sizes and reject oversized query strings or bodies. Limiting request body sizes and query string lengths at the web server or CDN level is an effective mitigation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rack | rack | < 2.2.14, >= 3.0, < 3.0.16, >= 3.1, < 3.1.14 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-rack | 3.1.16-0.1 | — |
| Debian 13 | ruby-rack | 3.1.16-0.1 | — |
| Debian 12 | ruby-rack | 2.2.20-0+deb12u1 | — |
| Debian 11 | ruby-rack | 2.1.4-3+deb11u4 | DLA-4357-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | ruby-rack | 3.1.16-0.1 | — |
| Ubuntu 24.04 LTS | ruby-rack | 2.2.7-1ubuntu0.3 | USN-7507-1 |
| Ubuntu 22.04 LTS | ruby-rack | 2.1.4-5ubuntu1.2 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | ruby-rack | 2.1.4-5ubuntu1.1+esm2 | USN-7507-1 |
| Ubuntu Pro 20.04 LTS | ruby-rack | 2.0.7-2ubuntu0.1+esm7 | USN-7507-1 |
| Ubuntu Pro 18.04 LTS | ruby-rack | 1.6.4-4ubuntu0.2+esm8 | USN-7507-1 |
| Ubuntu Pro 16.04 LTS | ruby-rack | 1.6.4-3ubuntu0.2+esm8 | USN-7507-1 |
| Ubuntu Pro 14.04 LTS | ruby-rack | 1.5.2-3+deb8u3ubuntu1~esm10 | USN-7507-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | pcs +2 | 0.12.0-3.el10_0.2 | RHSA-2025:8319 |
| RHEL 9 | pcs +1 | 0.11.9-2.el9_6.1 | RHSA-2025:8256 |
| RHEL 8 | pcs +1 | 0.10.18-2.el8_10.5 | RHSA-2025:8254 |
| RHEL 7 | pcs +1 | 0.9.169-3.el7_9.4 | RHSA-2025:8322 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | cjson | 1.7.18-1.el8sat | RHSA-2025:9838 |
| Red Hat Satellite Capsule 6 | python-sqlparse +1 | 0.5.0-1.el8pc | RHSA-2025:9838 |
| Red Hat Satellite Capsule 6 | rubygem-rack | 2.2.14-1.el8sat | RHSA-2025:9838, RHSA-2025:7605, RHSA-2025:7604 |
| Red Hat Satellite 6 | cjson | 1.7.18-1.el8sat | RHSA-2025:9838 |
| Red Hat Satellite 6 | python-sqlparse +1 | 0.5.0-1.el8pc | RHSA-2025:9838 |
| Red Hat Satellite 6 | rubygem-rack | 2.2.14-1.el8sat | RHSA-2025:9838, RHSA-2025:7605, RHSA-2025:7604 |
| RHEL 9.4 EUS | pcs +1 | 0.11.7-2.el9_4.4 | RHSA-2025:8288 |
| RHEL 9.2 EUS | pcs +1 | 0.11.4-7.el9_2.5 | RHSA-2025:8289 |
| RHEL 9.0 E4S | pcs +1 | 0.11.1-10.el9_0.8 | RHSA-2025:8291 |
| RHEL 8.8 EUS | pcs +1 | 0.10.15-4.el8_8.6 | RHSA-2025:8279 |
| RHEL 8.6 TUS | pcs +1 | 0.10.12-6.el8_6.8 | RHSA-2025:8290 |
| RHEL 8.6 E4S | pcs +1 | 0.10.12-6.el8_6.8 | RHSA-2025:8290 |
| RHEL 8.4 TUS | pcs +1 | 0.10.8-1.el8_4.7 | RHSA-2025:8323 |
| RHEL 8.4 E4S | pcs +1 | 0.10.8-1.el8_4.7 | RHSA-2025:8323 |
| RHEL 8.4 AUS | pcs +1 | 0.10.8-1.el8_4.7 | RHSA-2025:8323 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | pcs +1 | 0.10.18-2.el8_10.5.alma.1 | ALSA-2025:8254 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | pcs | 0.11.9-2.el9_6.1 | RLSA-2025:8256 |
| Rocky Linux 8 | pcs | 0.10.18-2.el8_10.5 | RLSA-2025:8254 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | rmt-server | 2.23-150700.3.6.1 | SUSE-SU-2025:02330-1 |
| SLES 15 SP7 | rubygem-rack | 2.0.8-150000.3.31.1 | SUSE-SU-2025:01586-2 |
| SLES 15 SP6 | rmt-server | 2.23-150500.3.34.2 | SUSE-SU-2025:02564-1 |
| SLES 15 SP6 | rubygem-rack | 2.0.8-150000.3.31.1 | SUSE-SU-2025:01586-1 |
| SLES 15 SP5 | rmt-server | 2.23-150500.3.34.2 | SUSE-SU-2025:02564-1 |
| SLES 15 SP5 | rubygem-rack | 2.0.8-150000.3.31.1 | SUSE-SU-2025:01586-1 |
| SLES 15 SP4 | rmt-server | 2.23-150400.3.42.1 | SUSE-SU-2025:02329-1 |
| SLES 15 SP4 | rubygem-rack | 2.0.8-150000.3.31.1 | SUSE-SU-2025:01586-1 |
| SLES 15 SP3 | rmt-server | 2.23-150300.3.54.1 | SUSE-SU-2025:02429-1 |
| SLES 15 SP3 | rubygem-rack | 2.0.8-150000.3.31.1 | SUSE-SU-2025:01586-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | rmt-server | 2.23-150500.3.34.2 | SUSE-SU-2025:02564-1 |
| SLES for SAP 15 SP4 | rmt-server | 2.23-150400.3.42.1 | SUSE-SU-2025:02329-1 |
| SLES for SAP 15 SP3 | rmt-server | 2.23-150300.3.54.1 | SUSE-SU-2025:02429-1 |
| SLE HPC 15 SP5 | rmt-server | 2.23-150500.3.34.2 | SUSE-SU-2025:02564-1 |
| SLE HPC 15 SP4 | rmt-server | 2.23-150400.3.42.1 | SUSE-SU-2025:02329-1 |
| SLE HPC 15 SP3 | rmt-server | 2.23-150300.3.54.1 | SUSE-SU-2025:02429-1 |
| SUSE Manager Server 4.3 | rmt-server | 2.23-150400.3.42.1 | SUSE-SU-2025:02329-1 |
| SUSE Manager Proxy 4.3 | rmt-server | 2.23-150400.3.42.1 | SUSE-SU-2025:02329-1 |
| SUSE Enterprise Storage 7.1 | rmt-server | 2.23-150300.3.54.1 | SUSE-SU-2025:02429-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rubygem-rack-2.2 | 2.2.14-1.1 | openSUSE-SU-2026:10286-1, openSUSE-SU-2025:15067-1 |
| openSUSE Leap 15.6 | rmt-server | 2.23-150500.3.34.2 | SUSE-SU-2025:02564-1 |
| openSUSE Leap 15.6 | rubygem-rack | 2.0.8-150000.3.31.1 | SUSE-SU-2025:01586-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | pcs +1 | 0.9.169-3.amzn2.3.0.6 | ALAS2-2025-2856 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | pcs +2 | 0.12.0-3.el10_0.2 | ELSA-2025-8319 |
| Oracle Linux 9 | pcs +1 | 0.11.9-2.el9_6.1 | ELSA-2025-8256 |
| Oracle Linux 8 | pcs +1 | 0.10.18-2.0.1.el8_10.5 | ELSA-2025-8254 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | logstash-8-with-output-opensearch | 8.18.1-r1 | — |
| Wolfi rolling | ruby3.2-rack-2.2 +3 | 2.2.22-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | rack | < 2.2.14 | 2.2.14 | GHSA-gjh7-p2fx-99vx |
| RubyGems | rack | >= 3.0, < 3.0.16 | 3.0.16 | GHSA-gjh7-p2fx-99vx |
| RubyGems | rack | >= 3.1, < 3.1.14 | 3.1.14 | GHSA-gjh7-p2fx-99vx |
Advisories 33
- ALSA-2025:8254 Important: pcs security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:9838 Red Hat Security Advisory: Satellite 6.15.5.3 Async Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8322 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8323 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8319 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8290 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8291 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8288 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8289 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8279 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8254 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:8256 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:7605 Red Hat Security Advisory: Satellite 6.16.5.1 Async Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:7604 Red Hat Security Advisory: Satellite 6.17.0.1 Async Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- USN-7507-1 ruby-rack vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- openSUSE-SU-2026:10286-1 ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:01586-2 Security update for rubygem-rack SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02429-1 Security update for rmt-server SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15067-1 ruby3.4-rubygem-rack-2.2-2.2.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 5, 2026
- SUSE-SU-2025:01586-1 Security update for rubygem-rack SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02564-1 Security update for rmt-server SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02329-1 Security update for rmt-server SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:02330-1 Security update for rmt-server SUSE / openSUSE Security Updates · Feb 4, 2026
- NCSC-2026-0022 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Jan 21, 2026
- WID-SEC-2026-0153 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- DLA-4357-1 ruby-rack - security update Debian Security (DSA / DLA) · Nov 1, 2025
- RLSA-2025:8256 Important: pcs security update Rocky Linux Security Advisories · Oct 7, 2025
- WID-SEC-2025-1067 Red Hat Satellite: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jul 30, 2025
- RLSA-2025:8254 Important: pcs security update Rocky Linux Security Advisories · Jul 29, 2025
- ELSA-2025-8319 Important: pcs security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 2, 2025
- ALAS2-2025-2856 Important: pcs security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 29, 2025
- ELSA-2025-8256 Important: pcs security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 29, 2025
- ELSA-2025-8254 Important: pcs security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 28, 2025