Description
Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (`CRLFCRLF`). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected. Versions 2.2.19, 3.1.17, and 3.2.2 cap per-part header size (e.g., 64 KiB). As a workaround, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx `client_max_body_size`).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rack | rack | < 2.2.19, >= 3.1, < 3.1.17, >= 3.2, < 3.2.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-rack | 3.1.18-1 | — |
| Debian 13 | ruby-rack | 3.1.18-1~deb13u1 | DSA-6048-1 |
| Debian 12 | ruby-rack | 2.2.20-0+deb12u1 | DSA-6048-1 |
| Debian 11 | ruby-rack | 2.1.4-3+deb11u4 | DLA-4357-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | ruby-rack | 3.1.16-0.1ubuntu0.1 | — |
| Ubuntu 24.04 LTS | ruby-rack | 2.2.7-1ubuntu0.5 | — |
| Ubuntu 22.04 LTS | ruby-rack | 2.1.4-5ubuntu1.2 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | ruby-rack | No fix yet | — |
| Ubuntu Pro 18.04 LTS | ruby-rack | No fix yet | — |
| Ubuntu Pro 16.04 LTS | ruby-rack | No fix yet | — |
| Ubuntu Pro 14.04 LTS | ruby-rack | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | pcs +2 | 0.12.0-3.el10_0.3 | RHSA-2025:21036, RHSA-2025:19513 |
| RHEL 9 | pcs +1 | 0.11.9-2.el9_6.2 | RHSA-2025:20962, RHSA-2025:19512 |
| RHEL 8 | pcs +1 | 0.10.18-2.el8_10.7 | RHSA-2025:19719 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.4 EUS | pcs +1 | 0.11.7-2.el9_4.5 | RHSA-2025:19736 |
| RHEL 9.2 E4S | pcs +1 | 0.11.4-7.el9_2.6 | RHSA-2025:19733 |
| RHEL 9.0 E4S | pcs +1 | 0.11.1-10.el9_0.9 | RHSA-2025:19800 |
| RHEL 8.8 TUS | pcs +1 | 0.10.15-4.el8_8.9 | RHSA-2025:19647 |
| RHEL 8.8 E4S | pcs +1 | 0.10.15-4.el8_8.9 | RHSA-2025:19647 |
| RHEL 8.6 TUS | pcs +1 | 0.10.12-6.el8_6.10 | RHSA-2025:19734 |
| RHEL 8.6 E4S | pcs +1 | 0.10.12-6.el8_6.10 | RHSA-2025:19734 |
| RHEL 8.4 EUS Long Life | pcs +1 | 0.10.8-1.el8_4.8 | RHSA-2025:19948 |
| RHEL 8.4 AUS | pcs +1 | 0.10.8-1.el8_4.8 | RHSA-2025:19948 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | cockpit-ha-cluster | 0.12.1-1.el10_1.1 | ALSA-2025:21036 |
| AlmaLinux 9 | pcs +1 | 0.11.10-1.el9_7.1 | ALSA-2025:20962 |
| AlmaLinux 8 | pcs +1 | 0.10.18-2.el8_10.7.alma.1 | ALSA-2025:19719 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | pcs | 0.11.9-2.el9_6.2 | RLSA-2025:20962, RLSA-2025:19512 |
| Rocky Linux 8 | pcs | 0.10.18-2.el8_10.7 | RLSA-2025:19719 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rubygem-rack-2.2 | 2.2.19-1.1 | openSUSE-SU-2026:10286-1, openSUSE-SU-2025:15621-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | pcs +1 | 0.9.169-3.amzn2.3.0.7 | ALAS2-2025-3046 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | pcs +2 | 0.12.0-3.0.1.el10_0.3 | ELSA-2025-21036, ELSA-2025-19513 |
| Oracle Linux 9 | pcs +1 | 0.11.9-2.el9_6.2 | ELSA-2025-20962, ELSA-2025-19512 |
| Oracle Linux 8 | pcs +1 | 0.10.18-2.0.1.el8_10.7 | ELSA-2025-19719 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | gitlab-cng-18.2 | 18.2.8-r0 | — |
| Wolfi rolling | ruby3.2-rack-2.2 +3 | 2.2.22-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | rack | < 2.2.19 | 2.2.19 | GHSA-wpv5-97wm-hp9c |
| RubyGems | rack | >= 3.1, < 3.1.17 | 3.1.17 | GHSA-wpv5-97wm-hp9c |
| RubyGems | rack | >= 3.2, < 3.2.2 | 3.2.2 | GHSA-wpv5-97wm-hp9c |
Advisories 28
- ALSA-2025:20962 Important: pcs security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:21036 Important: pcs security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2025:19719 Important: pcs security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:20962 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:21036 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19948 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19734 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19800 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19647 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19719 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19513 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19512 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 26, 2026
- RHSA-2025:19736 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- RHSA-2025:19733 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- openSUSE-SU-2026:10286-1 ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15621-1 ruby3.4-rubygem-rack-2.2-2.2.19-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-2482 Red Hat Enterprise Linux: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jan 14, 2026
- ELSA-2025-21036 Important: pcs security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Dec 2, 2025
- ELSA-2025-20962 Important: pcs security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 25, 2025
- RLSA-2025:20962 Important: pcs security update Rocky Linux Security Advisories · Nov 21, 2025
- ELSA-2025-19513 Important: pcs security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 7, 2025
- RLSA-2025:19512 Important: pcs security update Rocky Linux Security Advisories · Nov 6, 2025
- ELSA-2025-19719 Important: pcs security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 6, 2025
- RLSA-2025:19719 Important: pcs security update Rocky Linux Security Advisories · Nov 5, 2025
- DSA-6048-1 ruby-rack - security update Debian Security (DSA / DLA) · Nov 3, 2025
- ELSA-2025-19512 Important: pcs security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 3, 2025
- DLA-4357-1 ruby-rack - security update Debian Security (DSA / DLA) · Nov 1, 2025
- ALAS2-2025-3046 Important: pcs security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 27, 2025