Description
Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, ``Rack::Multipart::Parser` stores non-file form fields (parts without a `filename`) entirely in memory as Ruby `String` objects. A single large text field in a multipart/form-data request (hundreds of megabytes or more) can consume equivalent process memory, potentially leading to out-of-memory (OOM) conditions and denial of service (DoS). Attackers can send large non-file fields to trigger excessive memory usage. Impact scales with request size and concurrency, potentially leading to worker crashes or severe garbage-collection overhead. All Rack applications processing multipart form submissions are affected. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a reasonable size cap for non-file fields (e.g., 2 MiB). Workarounds include restricting maximum request body size at the web-server or proxy layer (e.g., Nginx `client_max_body_size`) and validating and rejecting unusually large form fields at the application level.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rack | rack | < 2.2.19, >= 3.1, < 3.1.17, >= 3.2, < 3.2.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-rack | 3.1.18-1 | — |
| Debian 13 | ruby-rack | 3.1.18-1~deb13u1 | DSA-6048-1 |
| Debian 12 | ruby-rack | 2.2.20-0+deb12u1 | DSA-6048-1 |
| Debian 11 | ruby-rack | 2.1.4-3+deb11u4 | DLA-4357-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | ruby-rack | 3.1.16-0.1ubuntu0.1 | — |
| Ubuntu 24.04 LTS | ruby-rack | 2.2.7-1ubuntu0.5 | — |
| Ubuntu 22.04 LTS | ruby-rack | 2.1.4-5ubuntu1.2 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | ruby-rack | No fix yet | — |
| Ubuntu Pro 18.04 LTS | ruby-rack | No fix yet | — |
| Ubuntu Pro 16.04 LTS | ruby-rack | No fix yet | — |
| Ubuntu Pro 14.04 LTS | ruby-rack | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | pcs +2 | 0.12.0-3.el10_0.3 | RHSA-2025:21036, RHSA-2025:19513 |
| RHEL 9 | pcs +1 | 0.11.9-2.el9_6.2 | RHSA-2025:20962, RHSA-2025:19512 |
| RHEL 8 | pcs +1 | 0.10.18-2.el8_10.7 | RHSA-2025:19719 |
| RHEL 7 | pcs +1 | 0.9.169-3.el7_9.5 | RHSA-2025:21696 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.0 E4S | pcs +1 | 0.11.1-10.el9_0.9 | RHSA-2025:19800 |
| RHEL 8.8 TUS | pcs +1 | 0.10.15-4.el8_8.9 | RHSA-2025:19647 |
| RHEL 8.8 E4S | pcs +1 | 0.10.15-4.el8_8.9 | RHSA-2025:19647 |
| RHEL 8.6 TUS | pcs +1 | 0.10.12-6.el8_6.10 | RHSA-2025:19734 |
| RHEL 8.6 E4S | pcs +1 | 0.10.12-6.el8_6.10 | RHSA-2025:19734 |
| RHEL 8.4 EUS Long Life | pcs +1 | 0.10.8-1.el8_4.8 | RHSA-2025:19948 |
| RHEL 8.4 AUS | pcs +1 | 0.10.8-1.el8_4.8 | RHSA-2025:19948 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | cockpit-ha-cluster | 0.12.1-1.el10_1.1 | ALSA-2025:21036 |
| AlmaLinux 9 | pcs +1 | 0.11.10-1.el9_7.1 | ALSA-2025:20962 |
| AlmaLinux 8 | pcs +1 | 0.10.18-2.el8_10.7.alma.1 | ALSA-2025:19719 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | pcs | 0.11.9-2.el9_6.2 | RLSA-2025:20962, RLSA-2025:19512 |
| Rocky Linux 8 | pcs | 0.10.18-2.el8_10.7 | RLSA-2025:19719 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rubygem-rack-2.2 | 2.2.19-1.1 | openSUSE-SU-2026:10286-1, openSUSE-SU-2025:15621-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | pcs +1 | 0.9.169-3.amzn2.3.0.7 | ALAS2-2025-3046 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | pcs +2 | 0.12.0-3.0.1.el10_0.3 | ELSA-2025-21036, ELSA-2025-19513 |
| Oracle Linux 9 | pcs +1 | 0.11.9-2.el9_6.2 | ELSA-2025-20962, ELSA-2025-19512 |
| Oracle Linux 8 | pcs +1 | 0.10.18-2.0.1.el8_10.7 | ELSA-2025-19719 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | gitlab-cng-18.2 | 18.2.8-r0 | — |
| Wolfi rolling | ruby3.2-rack-2.2 +3 | 2.2.22-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | rack | < 2.2.19 | 2.2.19 | GHSA-w9pc-fmgc-vxvw |
| RubyGems | rack | >= 3.1, < 3.1.17 | 3.1.17 | GHSA-w9pc-fmgc-vxvw |
| RubyGems | rack | >= 3.2, < 3.2.2 | 3.2.2 | GHSA-w9pc-fmgc-vxvw |
Advisories 27
- ALSA-2025:20962 Important: pcs security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:21036 Important: pcs security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:19719 Important: pcs security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:21696 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:20962 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:21036 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19948 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19734 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19800 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19647 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19719 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19513 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19512 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- openSUSE-SU-2026:10286-1 ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15621-1 ruby3.4-rubygem-rack-2.2-2.2.19-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-2482 Red Hat Enterprise Linux: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jan 14, 2026
- ELSA-2025-21036 Important: pcs security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Dec 2, 2025
- ELSA-2025-20962 Important: pcs security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 25, 2025
- RLSA-2025:20962 Important: pcs security update Rocky Linux Security Advisories · Nov 21, 2025
- ELSA-2025-19513 Important: pcs security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 7, 2025
- RLSA-2025:19512 Important: pcs security update Rocky Linux Security Advisories · Nov 6, 2025
- ELSA-2025-19719 Important: pcs security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 6, 2025
- RLSA-2025:19719 Important: pcs security update Rocky Linux Security Advisories · Nov 5, 2025
- DSA-6048-1 ruby-rack - security update Debian Security (DSA / DLA) · Nov 3, 2025
- ELSA-2025-19512 Important: pcs security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 3, 2025
- DLA-4357-1 ruby-rack - security update Debian Security (DSA / DLA) · Nov 1, 2025
- ALAS2-2025-3046 Important: pcs security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 27, 2025