Description
Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rack | rack | < 2.2.18 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-rack | 3.0.8-2 | — |
| Debian 13 | ruby-rack | 3.0.8-2 | — |
| Debian 12 | ruby-rack | 2.2.20-0+deb12u1 | — |
| Debian 11 | ruby-rack | 2.1.4-3+deb11u4 | DLA-4357-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | ruby-rack | 2.2.7-1ubuntu0.4 | USN-7784-1 |
| Ubuntu 22.04 LTS | ruby-rack | 2.1.4-5ubuntu1.2 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | ruby-rack | 2.0.7-2ubuntu0.1+esm8 | — |
| Ubuntu Pro 18.04 LTS | ruby-rack | No fix yet | — |
| Ubuntu Pro 16.04 LTS | ruby-rack | No fix yet | — |
| Ubuntu Pro 14.04 LTS | ruby-rack | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | pcs +2 | 0.12.0-3.el10_0.3 | RHSA-2025:21036, RHSA-2025:19513 |
| RHEL 9 | pcs +1 | 0.11.9-2.el9_6.2 | RHSA-2025:20962, RHSA-2025:19512 |
| RHEL 8 | pcs +1 | 0.10.18-2.el8_10.7 | RHSA-2025:19719 |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.9.1.13-1.el8sat | RHSA-2025:19856, RHSA-2025:19855, RHSA-2025:19832 |
| Red Hat Satellite Capsule 6 | foreman +2 | 3.9.1.13-1.el8sat | RHSA-2025:19856, RHSA-2025:19855, RHSA-2025:19832 |
| Red Hat Satellite Capsule 6 | rubygem-rack | 2.2.20-1.el8sat | RHSA-2025:19856, RHSA-2025:19855, RHSA-2025:19832 |
| Red Hat Satellite 6 | foreman +14 | 3.9.1.13-1.el8sat | RHSA-2025:19856, RHSA-2025:19855, RHSA-2025:19832 |
| Red Hat Satellite 6 | rubygem-rack | 2.2.20-1.el8sat | RHSA-2025:19856, RHSA-2025:19855, RHSA-2025:19832 |
| RHEL 9.4 EUS | pcs +1 | 0.11.7-2.el9_4.5 | RHSA-2025:19736 |
| RHEL 9.2 E4S | pcs +1 | 0.11.4-7.el9_2.6 | RHSA-2025:19733 |
| RHEL 9.0 E4S | pcs +1 | 0.11.1-10.el9_0.9 | RHSA-2025:19800 |
| RHEL 8.8 TUS | pcs +1 | 0.10.15-4.el8_8.9 | RHSA-2025:19647 |
| RHEL 8.8 E4S | pcs +1 | 0.10.15-4.el8_8.9 | RHSA-2025:19647 |
| RHEL 8.6 TUS | pcs +1 | 0.10.12-6.el8_6.10 | RHSA-2025:19734 |
| RHEL 8.6 E4S | pcs +1 | 0.10.12-6.el8_6.10 | RHSA-2025:19734 |
| RHEL 8.4 EUS Long Life | pcs +1 | 0.10.8-1.el8_4.8 | RHSA-2025:19948 |
| RHEL 8.4 AUS | pcs +1 | 0.10.8-1.el8_4.8 | RHSA-2025:19948 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | cockpit-ha-cluster | 0.12.1-1.el10_1.1 | ALSA-2025:21036 |
| AlmaLinux 9 | pcs +1 | 0.11.10-1.el9_7.1 | ALSA-2025:20962 |
| AlmaLinux 8 | pcs +1 | 0.10.18-2.el8_10.7.alma.1 | ALSA-2025:19719 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | pcs | 0.11.9-2.el9_6.2 | RLSA-2025:20962, RLSA-2025:19512 |
| Rocky Linux 8 | pcs | 0.10.18-2.el8_10.7 | RLSA-2025:19719 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rubygem-rack-2.2 | 2.2.18-1.1 | openSUSE-SU-2026:10286-1, openSUSE-SU-2025:15587-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | pcs +2 | 0.12.0-3.0.1.el10_0.3 | ELSA-2025-21036, ELSA-2025-19513 |
| Oracle Linux 9 | pcs +1 | 0.11.9-2.el9_6.2 | ELSA-2025-20962, ELSA-2025-19512 |
| Oracle Linux 8 | pcs +1 | 0.10.18-2.0.1.el8_10.7 | ELSA-2025-19719 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | ruby3.2-rack-2.2 +3 | 2.2.22-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | rack | < 2.2.18 | 2.2.18 | GHSA-625h-95r8-8xpm |
Advisories 30
- ALSA-2025:20962 Important: pcs security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:21036 Important: pcs security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:19719 Important: pcs security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:20962 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:21036 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19948 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19734 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19800 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19647 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19719 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19513 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19512 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19736 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- RHSA-2025:19733 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- RHSA-2025:19856 Red Hat Security Advisory: Satellite 6.15.5.6 Async Update Red Hat Security Advisories (RHSA) · Sep 1, 2026
- RHSA-2025:19855 Red Hat Security Advisory: Satellite 6.16.5.5 Async Update Red Hat Security Advisories (RHSA) · Sep 1, 2026
- RHSA-2025:19832 Red Hat Security Advisory: Satellite 6.17.6 Async Update Red Hat Security Advisories (RHSA) · Sep 1, 2026
- openSUSE-SU-2026:10286-1 ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15587-1 ruby3.4-rubygem-rack-2.2-2.2.18-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- USN-7784-1 ruby-rack vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- WID-SEC-2025-2482 Red Hat Enterprise Linux: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jan 14, 2026
- ELSA-2025-21036 Important: pcs security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Dec 2, 2025
- ELSA-2025-20962 Important: pcs security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 25, 2025
- RLSA-2025:20962 Important: pcs security update Rocky Linux Security Advisories · Nov 21, 2025
- ELSA-2025-19513 Important: pcs security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 7, 2025
- RLSA-2025:19512 Important: pcs security update Rocky Linux Security Advisories · Nov 6, 2025
- ELSA-2025-19719 Important: pcs security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 6, 2025
- RLSA-2025:19719 Important: pcs security update Rocky Linux Security Advisories · Nov 5, 2025
- ELSA-2025-19512 Important: pcs security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 3, 2025
- DLA-4357-1 ruby-rack - security update Debian Security (DSA / DLA) · Nov 1, 2025