CVE-2025-59830highCWE-400CWE-770

CVE-2025-59830: high-severity vulnerability in rack

Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters

Published

Follow this CVE+ Monitor rack+ Monitor rack

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.6%
In short

Rack's parameter parser has a flaw where it counts parameters separated by & but also accepts ; separators, allowing attackers to bypass the parameter limit and cause the server to use excessive CPU and memory.

Technical detail

CVE-2025-59830 exploits CWE-400 and CWE-770 by leveraging Rack::QueryParser's inconsistent delimiter handling—params_limit is enforced only for & separators while ; delimiters are still processed, enabling attackers to submit unbounded parameters and trigger denial-of-service through resource exhaustion when default configuration is used.

Summary generated and translated by AI from the official description.
Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
rack · rack
Related CVEs — rack

In the same product, most dangerous first.

CVE-2024-25126MEDIUMRack ReDos in content type parsing (2nd degree polynomial)EPSS 35.4%CVE-2019-16782MEDIUMPossible Information Leak / Session Hijack Vulnerability in RackEPSS 3.7%CVE-2024-26146MEDIUMPossible Denial of Service Vulnerability in Rack Header ParsingEPSS 2.0%CVE-2024-26141MEDIUMPossible DoS Vulnerability with Range Header in RackEPSS 1.6%CVE-2025-46727HIGHUnbounded-Parameter DoS in Rack::QueryParserEPSS 1.2%CVE-2025-25184MEDIUMPossible Log Injection in Rack::CommonLoggerEPSS 1.2%