Skip to content
OpenAdvisories
High · 7.5 CVE-2025-61919 EUVD-2025-33748GHSA-6xw4-3v39-52mm

Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing

Published Oct 10, 2025 · Updated Oct 10, 2025 · Assigned by GitHub_M

Vendor: rack Product: rack Package: gitlab-cng-18.2 Package: kube-fluentd-operator Package: kube-fluentd-operator-compat Package: kube-fluentd-operator-default-config Package: kube-fluentd-operator-oci-entrypoint Package: rack Package: ruby-rack Package: ruby-rack Package: ruby3.2-rack-2.2 Package: ruby3.3-rack-2.2 Package: ruby3.4-rack-2.2 Package: ruby4.0-rack-2.2 Ecosystem: Debian Ecosystem: RubyGems Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, `Rack::Request#POST` reads the entire request body into memory for `Content-Type: application/x-www-form-urlencoded`, calling `rack.input.read(nil)` without enforcing a length or cap. Large request bodies can therefore be buffered completely into process memory before parsing, leading to denial of service (DoS) through memory exhaustion. Users should upgrade to Rack version 2.2.20, 3.1.18, or 3.2.3, anu of which enforces form parameter limits using `query_parser.bytesize_limit`, preventing unbounded reads of `application/x-www-form-urlencoded` bodies. Additionally, enforce strict maximum body size at the proxy or web server layer (e.g., Nginx `client_max_body_size`, Apache `LimitRequestBody`).

Affected products

VendorProductAffectedFixed
rack rack < 2.2.20, >= 3.0, < 3.1.18, >= 3.2, < 3.2.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 ruby-rack 3.1.18-1 —
Debian 13 ruby-rack 3.1.18-1~deb13u1 DSA-6048-1
Debian 12 ruby-rack 2.2.20-0+deb12u1 DSA-6048-1
Debian 11 ruby-rack 2.1.4-3+deb11u4 DLA-4357-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 ruby-rack 3.1.16-0.1ubuntu0.1 —
Ubuntu 24.04 LTS ruby-rack 2.2.7-1ubuntu0.5 —
Ubuntu 22.04 LTS ruby-rack 2.1.4-5ubuntu1.2 —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS ruby-rack 2.0.7-2ubuntu0.1+esm8 —
Ubuntu Pro 18.04 LTS ruby-rack No fix yet —
Ubuntu Pro 16.04 LTS ruby-rack No fix yet —
Ubuntu Pro 14.04 LTS ruby-rack No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 pcs +2 0.12.0-3.el10_0.3 RHSA-2025:21036, RHSA-2025:19513
RHEL 9 pcs +1 0.11.9-2.el9_6.2 RHSA-2025:20962, RHSA-2025:19512
RHEL 8 pcs +1 0.10.18-2.el8_10.7 RHSA-2025:19719
RHEL 7 pcs +1 0.9.169-3.el7_9.5 RHSA-2025:21696
Show 12 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Satellite Utils 6 foreman +1 3.9.1.13-1.el8sat RHSA-2025:19856, RHSA-2025:19855, RHSA-2025:19832
Red Hat Satellite Capsule 6 foreman +2 3.9.1.13-1.el8sat RHSA-2025:19856, RHSA-2025:19855, RHSA-2025:19832
Red Hat Satellite Capsule 6 rubygem-rack 2.2.20-1.el8sat RHSA-2025:19856, RHSA-2025:19855, RHSA-2025:19832
Red Hat Satellite 6 foreman +14 3.9.1.13-1.el8sat RHSA-2025:19856, RHSA-2025:19855, RHSA-2025:19832
Red Hat Satellite 6 rubygem-rack 2.2.20-1.el8sat RHSA-2025:19856, RHSA-2025:19855, RHSA-2025:19832
RHEL 9.4 EUS pcs +1 0.11.7-2.el9_4.5 RHSA-2025:19736
RHEL 9.2 E4S pcs +1 0.11.4-7.el9_2.6 RHSA-2025:19733
RHEL 9.0 E4S pcs +1 0.11.1-10.el9_0.9 RHSA-2025:19800
RHEL 8.8 TUS pcs +1 0.10.15-4.el8_8.9 RHSA-2025:19647
RHEL 8.8 E4S pcs +1 0.10.15-4.el8_8.9 RHSA-2025:19647
RHEL 8.6 TUS pcs +1 0.10.12-6.el8_6.10 RHSA-2025:19734
RHEL 8.6 E4S pcs +1 0.10.12-6.el8_6.10 RHSA-2025:19734
RHEL 8.4 EUS Long Life pcs +1 0.10.8-1.el8_4.8 RHSA-2025:19948
RHEL 8.4 AUS pcs +1 0.10.8-1.el8_4.8 RHSA-2025:19948

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 cockpit-ha-cluster 0.12.1-1.el10_1.1 ALSA-2025:21036
AlmaLinux 9 pcs +1 0.11.10-1.el9_7.1 ALSA-2025:20962
AlmaLinux 8 pcs +1 0.10.18-2.el8_10.7.alma.1 ALSA-2025:19719

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 pcs 0.11.9-2.el9_6.2 RLSA-2025:20962, RLSA-2025:19512
Rocky Linux 8 pcs 0.10.18-2.el8_10.7 RLSA-2025:19719

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 rubygem-rack 2.2.20-150000.3.34.1 SUSE-SU-2025:4273-1
SLES 15 SP6 rubygem-rack 2.2.20-150000.3.34.1 SUSE-SU-2025:4273-1
SLES 15 SP5 rubygem-rack 2.2.20-150000.3.34.1 SUSE-SU-2025:4273-1
SLES 15 SP4 rubygem-rack 2.2.20-150000.3.34.1 SUSE-SU-2025:4273-1
SLES 15 SP3 rubygem-rack 2.2.20-150000.3.34.1 SUSE-SU-2025:4273-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 hawk2 2.7.0+git.1742310530.bfcd0e2c-160000.3.1 SUSE-SU-2026:20093-1
SLES 16.0 hawk2 2.7.0+git.1742310530.bfcd0e2c-160000.3.1 SUSE-SU-2026:20091-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed rubygem-rack-2.2 2.2.20-1.1 openSUSE-SU-2026:10286-1, openSUSE-SU-2025:15642-1
openSUSE Leap 16.0 hawk2 2.7.0+git.1742310530.bfcd0e2c-160000.3.1 openSUSE-SU-2026:20025-1
openSUSE Leap 15.6 rubygem-rack 2.2.20-150000.3.34.1 SUSE-SU-2025:4273-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 pcs +2 0.12.0-3.0.1.el10_0.3 ELSA-2025-21036, ELSA-2025-19513
Oracle Linux 9 pcs +1 0.11.9-2.el9_6.2 ELSA-2025-20962, ELSA-2025-19512
Oracle Linux 8 pcs +1 0.10.18-2.0.1.el8_10.7 ELSA-2025-19719

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling gitlab-cng-18.2 No fix yet —
Wolfi rolling kube-fluentd-operator +3 1.18.2-r49 —
Wolfi rolling ruby3.2-rack-2.2 +3 2.2.22-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems rack < 2.2.20 2.2.20 GHSA-6xw4-3v39-52mm
RubyGems rack >= 3.0, < 3.1.18 3.1.18 GHSA-6xw4-3v39-52mm
RubyGems rack >= 3.2, < 3.2.3 3.2.3 GHSA-6xw4-3v39-52mm

Advisories 35

References