PT-2025-39397 · Rack+8 · Rack+8
Kwkr
·
Published
2025-09-25
·
Updated
2026-04-05
·
CVE-2025-59830
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
rack versions prior to 2.2.18
Description:
A flaw exists in
Rack::QueryParser where the params limit is not correctly enforced when parameters are separated by semicolons (;) instead of ampersands (&). The parser counts only ampersands when enforcing the limit, while splitting on both. This allows attackers to bypass the parameter count limit and potentially cause a denial-of-service condition due to increased CPU and memory consumption.Recommendations:
Upgrade to version 2.2.18 or later to address this issue. If upgrading is not immediately possible, configure
QueryParser with an explicit delimiter (e.g., &) to avoid the mismatch.Exploit
Fix
DoS
Resource Exhaustion
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Centos
Debian
Linuxmint
Rack
Red Hat
Red Os
Rocky Linux
Ubuntu