Sinatra CVE-2025-61921

Exploitation requires three concrete conditions to all hold: (1) the application must call Sinatra's etag method when constructing a response, which drives parsing of client-supplied If-Match / If-None-Match headers; (2) the underlying Ruby runtime must be below version 3.2, since Ruby 3.2+ fixed the regex engine behavior (bugs.ruby-lang.org/issues/19104) that enables the catastrophic backtracking; and (3) the attacker must reach the affected endpoint with a controlled If-Match/If-None-Match header. Limiting factors: applications on Ruby >= 3.2 are not affected even on vulnerable Sinatra versions, and applications that never use etag are not impacted - so despite the unauthenticated network vector, realistic exposure is confined to older-Ruby deployments using ETag generation.

This is a low-severity, low-priority issue despite being network-reachable and unauthenticated. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated reachability, but the only impact is VA:L - a partial, bounded availability degradation (ReDoS CPU consumption), with no confidentiality or integrity impact (VC:N/VI:N) - yielding the low base score of 2.7. EPSS is modest at 0.50% (41st percentile), consistent with a low-impact DoS that is not an attractive mass-exploitation target. There is NO CISA KEV listing, so exploitation status is: no public exploit identified at time of analysis - note that although the input marks a reference as 'exploit', that reference (PR 1823) is actually the fix for an OLDER, separate ReDoS issue per the GHSA advisory, not weaponized exploit code for this CVE, so POC availability for CVE-2025-61921 specifically is not substantiated by the provided evidence. Signals are therefore consistent (low CVSS + low EPSS + no KEV = genuinely low real-world risk), with one important caveat the NVD data omits: the GHSA advisory states exploitation requires Ruby < 3.2, which substantially narrows the exposed population versus what the NVD description implies.

A remote, unauthenticated attacker sends an HTTP request containing a specially crafted If-Match or If-None-Match header to a public Sinatra endpoint whose handler calls the etag method while running on Ruby < 3.2. The pathological input triggers catastrophic regular-expression backtracking during header parsing, consuming excessive CPU and degrading or temporarily denying service. No confirmed working PoC for this specific CVE is provided (the referenced 'exploit' link is a fix for an earlier, distinct ReDoS).