PT-2025-41013 · Rack+8 · Rack+8
Kwkr
·
Published
2025-10-07
·
Updated
2026-04-09
·
CVE-2025-61771
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Rack versions prior to 2.2.19
Rack versions prior to 3.1.17
Rack versions prior to 3.2.2
Description
Rack is a modular Ruby web server interface. The
Rack::Multipart::Parser component stores non-file form fields in memory as Ruby String objects. A large text field within a multipart/form-data request can consume significant process memory, potentially leading to out-of-memory (OOM) conditions and denial of service (DoS). Attackers can exploit this by sending requests with large non-file fields, causing excessive memory usage and potentially crashing workers or increasing garbage-collection overhead. All Rack applications processing multipart form submissions are potentially affected.Recommendations
Update to Rack version 2.2.19 or later.
Update to Rack version 3.1.17 or later.
Update to Rack version 3.2.2 or later.
Restrict maximum request body size at the web-server or proxy layer.
Validate and reject unusually large form fields at the application level.
Exploit
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Centos
Debian
Linuxmint
Rack
Red Hat
Red Os
Rocky Linux
Ubuntu