CVE-2025-61770highCWE-400

CVE-2025-61770: high-severity vulnerability in rack

Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)

Published

Follow this CVE+ Monitor rack+ Monitor rack

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.9%
In short

Rack's multipart parser stores unlimited data from the start of a multipart request in memory without checks, allowing attackers to send huge preambles that exhaust memory and crash the application.

Technical detail

CVE-2025-61770 is a resource exhaustion vulnerability in Rack's multipart parser (CWE-400) affecting versions before 2.2.19, 3.1.17, and 3.2.2. An unauthenticated remote attacker can send a multipart/form-data request with an arbitrarily large preamble before the first boundary, causing unbounded memory buffering and OOM conditions. The vulnerability is mitigated in patched versions through preamble size limits or discard mechanisms.

Summary generated and translated by AI from the official description.
Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` buffers the entire multipart preamble (bytes before the first boundary) in memory without any size limit. A client can send a large preamble followed by a valid boundary, causing significant memory use and potential process termination due to out-of-memory (OOM) conditions. Remote attackers can trigger large transient memory spikes by including a long preamble in multipart/form-data requests. The impact scales with allowed request sizes and concurrency, potentially causing worker crashes or severe slowdown due to garbage collection. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a preamble size limit (e.g., 16 KiB) or discard preamble data entirely. Workarounds include limiting total request body size at the proxy or web server level and monitoring memory and set per-process limits to prevent OOM conditions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
rack · rack
Related CVEs — rack

In the same product, most dangerous first.

CVE-2024-25126MEDIUMRack ReDos in content type parsing (2nd degree polynomial)EPSS 35.4%CVE-2019-16782MEDIUMPossible Information Leak / Session Hijack Vulnerability in RackEPSS 3.7%CVE-2024-26146MEDIUMPossible Denial of Service Vulnerability in Rack Header ParsingEPSS 2.0%CVE-2024-26141MEDIUMPossible DoS Vulnerability with Range Header in RackEPSS 1.6%CVE-2025-46727HIGHUnbounded-Parameter DoS in Rack::QueryParserEPSS 1.2%CVE-2025-25184MEDIUMPossible Log Injection in Rack::CommonLoggerEPSS 1.2%