PT-2025-41132 · Rack+8 · Rack+8
Kwkr
·
Published
2025-10-07
·
Updated
2026-04-09
·
CVE-2025-61772
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Rack versions prior to 2.2.19
Rack versions prior to 3.1.17
Rack versions prior to 3.2.2
Description
Rack is a modular Ruby web server interface. The
Rack::Multipart::Parser component can accumulate unbounded data when processing multipart requests with incomplete header blocks that lack the required blank line. This allows a remote attacker to exhaust memory, potentially leading to a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory usage, resulting in process termination or significant performance degradation. The impact is proportional to request size limits and concurrency. Applications handling multipart uploads may be affected. The parser keeps appending incoming bytes to memory without a size cap.Recommendations
Update to Rack version 2.2.19 or later.
Update to Rack version 3.1.17 or later.
Update to Rack version 3.2.2 or later.
As a workaround, restrict maximum request sizes at the proxy or web server layer.
Exploit
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Centos
Debian
Linuxmint
Rack
Red Hat
Red Os
Rocky Linux
Ubuntu