Rack
CVE-2025-61770
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify endpoint parsing multipart form-data
-
DeliveryCraft request with huge pre-boundary preamble
-
ExploitRack buffers preamble unbounded in memory
-
ExecutionRepeat across concurrent connections
-
PersistExhaust worker memory, trigger OOM/GC thrash
-
ImpactWorker crash or service slowdown
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target application must accept and parse multipart/form-data requests through Rack::Multipart::Parser (i.e. any endpoint handling HTML form or file uploads) on an affected version (< 2.2.19, 3.1.x < 3.1.17, or 3.2.x < 3.2.2). No authentication, user interaction, or non-default configuration is required for the parse path itself. The practical severity is LIMITED by deployment-level factors: the maximum damage scales directly with the request-body size the front-end proxy/web server permits and with worker concurrency, so a strict upstream body-size cap (e.g. in nginx/HAProxy) sharply reduces impact; per-process memory limits further bound the effect to controlled worker restarts rather than host-wide OOM. |
| Impact | This is a genuine but moderate-priority availability issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) is internally consistent with the description: a remote, unauthenticated attacker can send malformed multipart/form-data over the network with low complexity and no user interaction, impacting only availability (CWE-400 resource exhaustion). The SSVC/real-world signals temper the raw score: EPSS is just 0.93% (60th percentile), there is no CISA KEV listing, and no public exploit has been identified - so despite the 'network/no-auth' profile this is not currently seeing broad opportunistic exploitation. Technical impact is partial rather than total system compromise: the flaw causes transient memory spikes and GC pressure, and only 'potential' OOM worker termination, so the A:H rating is arguably generous (A:L is defensible since impact scales with configured request-size limits and concurrency rather than guaranteeing a crash). Weighing the signals together: confirmed, easily-reachable, unauthenticated DoS vector against a foundational library (raising priority) versus confidentiality/integrity untouched, no active exploitation, and straightforward proxy-level mitigation (lowering it). Net: patch promptly as routine hardening, especially on internet-facing Ruby apps that accept file uploads, but this does not warrant out-of-band emergency response absent a KEV change. |
| Exploit ScenarioDerived | An attacker sends a multipart/form-data POST to any endpoint that parses uploads via Rack (e.g. a login, upload, or form handler), prefixing the request with a multi-megabyte preamble of junk bytes before the first valid boundary; Rack::Multipart::Parser buffers the entire preamble in memory with no cap. Repeating this across concurrent connections, sized up to the server's allowed request-body limit, drives worker memory exhaustion, GC thrashing, and potential OOM crashes. No public exploit code is identified, though the vendor's regression tests demonstrate the triggering request structure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Memory exhaustion in Rack's multipart/form-data parser allows unauthenticated remote attackers to crash or severely degrade Ruby web workers by sending a request body whose preamble (bytes before the first MIME boundary) is arbitrarily large. Any application running an affected version (< 2.2.19, 3.1.x < 3.1.17, or 3.2.x < 3.2.2) that accepts multipart uploads or HTML form posts is exposed; the blast radius scales with the request-body size the front-end proxy permits and with worker concurrency, and manifests as OOM kills, garbage-collection stalls, or process restarts. No public exploit code exists and there is no evidence of active exploitation (no CISA KEV listing); EPSS is a modest 0.93% (60th percentile), consistent with a genuine but moderate-priority availability issue rather than an emergency.
RemediationAI
Vendor-released patch: upgrade Rack to 2.2.19, 3.1.17, or 3.2.2 depending on your release line (the fix commits are 589127f4ac8b5cf11cf88fb0cd116ffed4d2181e, d869fed663b113b95a74ad53e1b5cae6ab31f29e, and e08f78c656c9394d6737c022bde087e0f33336fd, documented in GHSA-p543-xpfm-54cp); since Rack is usually a transitive dependency, run bundle update rack and confirm the locked version, and take the same upgrade to close CVE-2025-61771 and CVE-2025-61772. If the upgrade cannot be shipped immediately, apply compensating controls in this order: cap the total request body size at the edge (nginx client_max_body_size 1m;, HAProxy or an ALB/API-gateway equivalent) - this is the single most effective mitigation because impact scales directly with permitted body size, though it will reject or truncate legitimate large uploads; set per-process memory limits (ulimit -v / container memory limits / Puma worker RSS watchdogs) so that a hostile request causes a bounded, supervised worker restart rather than a host-wide OOM kill, accepting brief 5xx responses during restarts; restrict or temporarily disable multipart upload endpoints and require authentication on them, trading functionality for exposure reduction; and alert on rapid RSS growth or Rack::Multipart::Error rates in workers to catch probing early. Once patched, keep upstream body-size limits in place as defense in depth, since the parser's effective ceiling can still reach roughly the size of its 1 MB read buffer.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in rubygems
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Rack::Multipart::Parser is the component Ruby web applications rely on to decode multipart/form-data bodies. While searching for the first boundary delimiter, the parser appends every incoming chunk to a shared string buffer (@sbuf.concat(content)) and repeatedly calls @sbuf.scan_until(@body_regex); when the boundary has not yet appeared it simply keeps buffering, with no trim and no cap on the preamble. This is CWE-400 (Uncontrolled Resource Consumption): the amount of memory allocated is entirely attacker-controlled up to the size the HTTP server or proxy is willing to stream. RFC 2046 § 5.1.1 treats preamble content as discardable, so the fix is both a hard cap and a semantic correction - the upstream commits (589127f4ac8b5cf11cf88fb0cd116ffed4d2181e and related) add a private BOUNDARY_START_LIMIT of 16 KiB and a MIME_HEADER_BYTESIZE_LIMIT of 64 KiB, raising Rack::Multipart::Error ("multipart boundary not found within limit" / "multipart mime part header too large") instead of growing the buffer. Note in the diff comments that the effective ceiling is the greater of the new constant and the existing 1 MB read buffer, so a hostile client can still force roughly that much transient allocation per in-flight request. The same 2.2.19 / 3.1.17 / 3.2.2 releases also fix related parser memory issues tracked as CVE-2025-61771 (large non-file fields buffered wholly in memory) and CVE-2025-61772 (unbounded per-part headers), so the three should be treated as one patch event.
Know when Rack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated multipart request with no interaction drives memory exhaustion (AV:N/AC:L/PR:N/UI:N); only availability is affected, no confidentiality or integrity impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
DescriptionCVE.org
Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, Rack::Multipart::Parser buffers the entire multipart preamble (bytes before the first boundary) in memory without any size limit. A client can send a large preamble followed by a valid boundary, causing significant memory use and potential process termination due to out-of-memory (OOM) conditions. Remote attackers can trigger large transient memory spikes by including a long preamble in multipart/form-data requests. The impact scales with allowed request sizes and concurrency, potentially causing worker crashes or severe slowdown due to garbage collection. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a preamble size limit (e.g., 16 KiB) or discard preamble data entirely. Workarounds include limiting total request body size at the proxy or web server level and monitoring memory and set per-process limits to prevent OOM conditions.
Executive ViewAI
Rack's multipart/form-data parser can be driven into memory exhaustion, allowing crafted uploads or form posts to crash or severely degrade Ruby web workers in applications that accept multipart requests. The issue affects Rack versions before 2.2.19, 3.1.x before 3.1.17, and 3.2.x before 3.2.2, making it a service-availability risk for customer-facing and internal Ruby applications, with impact scaled by proxy request-size limits and worker concurrency. Vendor patches are available, and no public exploit identified at time of analysis and no CISA KEV listing was present.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Directory traversal in Rack versions prior to 2.2.22, 3.1.20, and 3.2.5 allows unauthenticated remote attackers to list
Rack is a modular Ruby web server interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable,
Rack is a modular Ruby web server interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable,
A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 tha
A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell
Rack provides an interface for developing web applications in Ruby. Rated medium severity (CVSS 5.7), this vulnerability
Rack's Directory module fails to sanitize filenames when generating HTML directory listings, allowing attackers to craft
Session authentication bypass in Rack::Session::Cookie 2.0.0 through 2.1.1 allows unauthenticated remote attackers to fo
A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerabi
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x
A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing co
Memory exhaustion denial of service in the Ruby Rack web server interface (versions prior to 2.2.19, 3.1.17, and 3.2.2)
Exploit-DB