Description
Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` buffers the entire multipart preamble (bytes before the first boundary) in memory without any size limit. A client can send a large preamble followed by a valid boundary, causing significant memory use and potential process termination due to out-of-memory (OOM) conditions. Remote attackers can trigger large transient memory spikes by including a long preamble in multipart/form-data requests. The impact scales with allowed request sizes and concurrency, potentially causing worker crashes or severe slowdown due to garbage collection. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a preamble size limit (e.g., 16 KiB) or discard preamble data entirely. Workarounds include limiting total request body size at the proxy or web server level and monitoring memory and set per-process limits to prevent OOM conditions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rack | rack | < 2.2.19, >= 3.1, < 3.1.17, >= 3.2, < 3.2.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-rack | 3.1.18-1 | — |
| Debian 13 | ruby-rack | 3.1.18-1~deb13u1 | DSA-6048-1 |
| Debian 12 | ruby-rack | 2.2.20-0+deb12u1 | DSA-6048-1 |
| Debian 11 | ruby-rack | 2.1.4-3+deb11u4 | DLA-4357-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | ruby-rack | 3.1.16-0.1ubuntu0.1 | — |
| Ubuntu 24.04 LTS | ruby-rack | 2.2.7-1ubuntu0.5 | — |
| Ubuntu 22.04 LTS | ruby-rack | 2.1.4-5ubuntu1.2 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | ruby-rack | No fix yet | — |
| Ubuntu Pro 18.04 LTS | ruby-rack | No fix yet | — |
| Ubuntu Pro 16.04 LTS | ruby-rack | No fix yet | — |
| Ubuntu Pro 14.04 LTS | ruby-rack | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | pcs +2 | 0.12.0-3.el10_0.3 | RHSA-2025:21036, RHSA-2025:19513 |
| RHEL 9 | pcs +1 | 0.11.9-2.el9_6.2 | RHSA-2025:20962, RHSA-2025:19512 |
| RHEL 8 | pcs +1 | 0.10.18-2.el8_10.7 | RHSA-2025:19719 |
| RHEL 7 | pcs +1 | 0.9.169-3.el7_9.5 | RHSA-2025:21696 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | pcs +1 | 0.11.7-2.el9_4.5 | RHSA-2025:19736 |
| RHEL 9.2 E4S | pcs +1 | 0.11.4-7.el9_2.6 | RHSA-2025:19733 |
| RHEL 9.0 E4S | pcs +1 | 0.11.1-10.el9_0.9 | RHSA-2025:19800 |
| RHEL 8.8 TUS | pcs +1 | 0.10.15-4.el8_8.9 | RHSA-2025:19647 |
| RHEL 8.8 E4S | pcs +1 | 0.10.15-4.el8_8.9 | RHSA-2025:19647 |
| RHEL 8.6 TUS | pcs +1 | 0.10.12-6.el8_6.10 | RHSA-2025:19734 |
| RHEL 8.6 E4S | pcs +1 | 0.10.12-6.el8_6.10 | RHSA-2025:19734 |
| RHEL 8.4 EUS Long Life | pcs +1 | 0.10.8-1.el8_4.8 | RHSA-2025:19948 |
| RHEL 8.4 AUS | pcs +1 | 0.10.8-1.el8_4.8 | RHSA-2025:19948 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | cockpit-ha-cluster | 0.12.1-1.el10_1.1 | ALSA-2025:21036 |
| AlmaLinux 9 | pcs +1 | 0.11.10-1.el9_7.1 | ALSA-2025:20962 |
| AlmaLinux 8 | pcs +1 | 0.10.18-2.el8_10.7.alma.1 | ALSA-2025:19719 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | pcs | 0.11.9-2.el9_6.2 | RLSA-2025:20962, RLSA-2025:19512 |
| Rocky Linux 8 | pcs | 0.10.18-2.el8_10.7 | RLSA-2025:19719 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rubygem-rack-2.2 | 2.2.19-1.1 | openSUSE-SU-2026:10286-1, openSUSE-SU-2025:15621-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | pcs +1 | 0.9.169-3.amzn2.3.0.7 | ALAS2-2025-3046 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | pcs +2 | 0.12.0-3.0.1.el10_0.3 | ELSA-2025-21036, ELSA-2025-19513 |
| Oracle Linux 9 | pcs +1 | 0.11.9-2.el9_6.2 | ELSA-2025-20962, ELSA-2025-19512 |
| Oracle Linux 8 | pcs +1 | 0.10.18-2.0.1.el8_10.7 | ELSA-2025-19719 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | gitlab-cng-18.2 | 18.2.8-r0 | — |
| Wolfi rolling | ruby3.2-rack-2.2 +3 | 2.2.22-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | rack | < 2.2.19 | 2.2.19 | GHSA-p543-xpfm-54cp |
| RubyGems | rack | >= 3.1, < 3.1.17 | 3.1.17 | GHSA-p543-xpfm-54cp |
| RubyGems | rack | >= 3.2, < 3.2.2 | 3.2.2 | GHSA-p543-xpfm-54cp |
Advisories 29
- ALSA-2025:20962 Important: pcs security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:21036 Important: pcs security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:19719 Important: pcs security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:21696 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:20962 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:21036 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19948 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19734 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19800 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19647 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19719 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19513 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19512 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19736 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- RHSA-2025:19733 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- openSUSE-SU-2026:10286-1 ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15621-1 ruby3.4-rubygem-rack-2.2-2.2.19-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-2482 Red Hat Enterprise Linux: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jan 14, 2026
- ELSA-2025-21036 Important: pcs security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Dec 2, 2025
- ELSA-2025-20962 Important: pcs security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 25, 2025
- RLSA-2025:20962 Important: pcs security update Rocky Linux Security Advisories · Nov 21, 2025
- ELSA-2025-19513 Important: pcs security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 7, 2025
- RLSA-2025:19512 Important: pcs security update Rocky Linux Security Advisories · Nov 6, 2025
- ELSA-2025-19719 Important: pcs security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 6, 2025
- RLSA-2025:19719 Important: pcs security update Rocky Linux Security Advisories · Nov 5, 2025
- DSA-6048-1 ruby-rack - security update Debian Security (DSA / DLA) · Nov 3, 2025
- ELSA-2025-19512 Important: pcs security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 3, 2025
- DLA-4357-1 ruby-rack - security update Debian Security (DSA / DLA) · Nov 1, 2025
- ALAS2-2025-3046 Important: pcs security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 27, 2025