Rack
CVE-2025-61772
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted multipart/form-data request
-
DeliveryOmit terminating CRLFCRLF in part header
-
ExploitParser buffers header bytes unbounded
-
ExecutionScale via large body and concurrency
-
PersistExhaust process memory (OOM)
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target application actually invokes Rack::Multipart::Parser - i.e. it accepts and parses multipart/form-data requests (file uploads or multipart forms), which is very common but not present on every endpoint. The specific trigger is a multipart part whose header block omits the terminating blank line (CRLFCRLF), causing @sbuf.concat to buffer without bound. No authentication is required (PR:N) and no special non-default Rack configuration is needed on vulnerable versions. Severity scales with the server's maximum request/body size limits and connection concurrency, so the practical limiting factors are any upstream request-size cap (e.g. Nginx client_max_body_size), per-process memory limits, and whether the exposed route parses multipart input at all. |
| Impact | All signals align on a moderate-severity, high-confidence denial-of-service issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remote, unauthenticated, low-complexity attack with no user interaction that impacts availability only (no confidentiality or integrity loss), fully consistent with the CWE-400 uncontrolled-resource-consumption / memory-exhaustion description and the GitHub advisory. EPSS is low (0.93%, 60th percentile), the CVE is NOT on the CISA KEV list, and no public weaponized exploit is referenced - only vendor regression test cases in the fix commit. These signals are not conflicting: a pure availability (A:H, C:N/I:N) DoS in a library is typically deprioritized relative to RCE-class flaws, and the low EPSS reflects that memory-exhaustion DoS is rarely mass-automated. Real priority is driven less by exploit likelihood and more by Rack's enormous deployment footprint across the Ruby ecosystem (Rails, Sinatra, etc.): any internet-facing Rack app accepting multipart uploads is reachable. Net assessment - a legitimate patch-soon issue for Ruby web operators, but not an emergency relative to actively-exploited or code-execution CVEs. No provided signals contradict one another. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends an HTTP multipart/form-data request to any endpoint that parses multipart input, crafting a part whose header block never terminates with the required blank line (CRLFCRLF). The Rack parser keeps appending incoming bytes to memory without a cap, so a single large or slow request - amplified by concurrent connections - exhausts process memory and triggers OOM termination or severe slowdown. No public exploit is referenced, though the fix commit includes test cases demonstrating the unbounded-buffer trigger. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Memory exhaustion denial of service in the Ruby Rack web server interface (versions prior to 2.2.19, 3.1.17, and 3.2.2) allows remote attackers to crash or severely degrade any endpoint that parses multipart/form-data requests. By sending a multipart part whose header block never terminates with the required CRLFCRLF blank line, an attacker forces Rack::Multipart::Parser to append incoming bytes to an in-memory buffer indefinitely, since vulnerable releases impose no per-part header size cap. No authentication is required (PR:N in the CVSS vector) and no non-default configuration is needed; impact scales with the server's maximum request body limit and request concurrency. The issue is fixed by vendor-released patches (2.2.19, 3.1.17, 3.2.2), EPSS is low at 0.93% (60th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade rack to 2.2.19, 3.1.17, or 3.2.2 (all released 2025-10-07), matching your current minor line; the fixes are commits 589127f4ac8b5cf11cf88fb0cd116ffed4d2181e, d869fed663b113b95a74ad53e1b5cae6ab31f29e, and e08f78c656c9394d6737c022bde087e0f33336fd, and the advisory is at https://github.com/rack/rack/security/advisories/GHSA-wpv5-97wm-hp9c. Because the patch caps per-part headers at 64 KiB and boundary-start data at 16 KiB, confirm after upgrading that legitimate clients do not send oversized upload headers, since excess will now raise Rack::Multipart::Error rather than buffer - a trade-off worth exercising in staging. If immediate upgrade is impossible, the effective compensating control is an upstream request-body cap that keeps a single streamed header below memory-damaging size: set Nginx client_max_body_size to a value matched to your legitimate upload ceiling and, ideally, add proxy_request_buffering on so Nginx buffers rather than streams large bodies to the Ruby backend; the trade-off is that this cap applies to all request bodies and will reject legitimately large uploads above the limit. Additionally enforce per-process memory limits (e.g. systemd MemoryMax, container memory limits with sane OOM behavior) so an exhausted worker dies and is replaced rather than dragging down the host, restrict multipart-accepting routes to authenticated users where business logic allows, and rate-limit or time out slow uploads at the proxy layer - noting that these reduce but do not eliminate exposure until the gem is upgraded.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in rubygems
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Rack is the modular Ruby web server interface that sits beneath most Ruby web frameworks (Rails, Sinatra, Hanami) and translates HTTP requests into a common env hash. Multipart parsing is handled by Rack::Multipart::Parser, which streams the request body and, for each multipart part, must locate the header terminator using a regular expression scan (@sbuf.scan_until(/(.*?\r\n)\r\n/m)). If the terminating CRLFCRLF never arrives, the parser's loop keeps concatenating newly read content into the shared StringScanner buffer with no ceiling. This is CWE-400 (Uncontrolled Resource Consumption): memory grows proportionally to the bytes the client streams, and with concurrent connections or a generous client_max_body_size the process can be driven to OOM termination or extreme slowdown. The upstream fix introduces explicit constants in lib/rack/multipart/parser.rb - MIME_HEADER_BYTESIZE_LIMIT of 64 KiB for per-part headers and BOUNDARY_START_LIMIT of 16 KiB for the initial preamble/boundary hunt - raising Rack::Multipart::Error when the buffer exceeds them. Note the effective ceiling is the higher of the constant and the 1 MB default read buffer, and the same release trains also fixed sibling DoS issues CVE-2025-61770 (unbounded multipart preamble) and CVE-2025-61771 (large non-file fields buffered in memory).
Know when Rack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated multipart request, no user interaction (AV:N/AC:L/PR:N/UI:N); pure memory-exhaustion DoS yields A:H with no confidentiality or integrity impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
DescriptionCVE.org
Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, Rack::Multipart::Parser can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (CRLFCRLF). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected. Versions 2.2.19, 3.1.17, and 3.2.2 cap per-part header size (e.g., 64 KiB). As a workaround, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx client_max_body_size).
Executive ViewAI
The Ruby Rack web server interface is affected by a high-severity, unauthenticated denial-of-service vulnerability that can exhaust memory and crash or degrade services that parse multipart form data. Leadership should care because affected customer-facing and internal Ruby applications may experience availability disruptions until dependency upgrades are completed across application teams. Patched Rack releases are available, and no public exploit was identified at time of analysis, so prioritization should focus on exposed multipart endpoints and coordinated remediation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Directory traversal in Rack versions prior to 2.2.22, 3.1.20, and 3.2.5 allows unauthenticated remote attackers to list
Rack is a modular Ruby web server interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable,
Rack is a modular Ruby web server interface. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable,
A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 tha
A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell
Rack provides an interface for developing web applications in Ruby. Rated medium severity (CVSS 5.7), this vulnerability
Rack's Directory module fails to sanitize filenames when generating HTML directory listings, allowing attackers to craft
Session authentication bypass in Rack::Session::Cookie 2.0.0 through 2.1.1 allows unauthenticated remote attackers to fo
A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerabi
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x
A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing co
Memory exhaustion in Rack's multipart/form-data parser allows unauthenticated remote attackers to crash or severely degr
Exploit-DB