CVE-2025-61919highCWE-400

CVE-2025-61919: high-severity vulnerability in rack

Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing

Published

Follow this CVE+ Monitor rack+ Monitor rack

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.6%
In short

Rack web servers can be crashed by sending very large form data requests that consume all available memory. An attacker can exploit this by submitting oversized URL-encoded forms, causing the server to run out of memory and stop responding.

Technical detail

Rack::Request#POST in versions prior to 2.2.20, 3.1.18, and 3.2.3 performs unbounded buffering of application/x-www-form-urlencoded request bodies via rack.input.read(nil), lacking enforced size limits. An unauthenticated remote attacker can send a large POST request with Content-Type: application/x-www-form-urlencoded to exhaust server memory and trigger denial of service. Mitigation requires upgrading to patched versions and enforcing body size limits at the proxy/web server layer.

Summary generated and translated by AI from the official description.
Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, `Rack::Request#POST` reads the entire request body into memory for `Content-Type: application/x-www-form-urlencoded`, calling `rack.input.read(nil)` without enforcing a length or cap. Large request bodies can therefore be buffered completely into process memory before parsing, leading to denial of service (DoS) through memory exhaustion. Users should upgrade to Rack version 2.2.20, 3.1.18, or 3.2.3, anu of which enforces form parameter limits using `query_parser.bytesize_limit`, preventing unbounded reads of `application/x-www-form-urlencoded` bodies. Additionally, enforce strict maximum body size at the proxy or web server layer (e.g., Nginx `client_max_body_size`, Apache `LimitRequestBody`).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
rack · rack
Related CVEs — rack

In the same product, most dangerous first.

CVE-2024-25126MEDIUMRack ReDos in content type parsing (2nd degree polynomial)EPSS 35.4%CVE-2019-16782MEDIUMPossible Information Leak / Session Hijack Vulnerability in RackEPSS 3.7%CVE-2024-26146MEDIUMPossible Denial of Service Vulnerability in Rack Header ParsingEPSS 2.0%CVE-2024-26141MEDIUMPossible DoS Vulnerability with Range Header in RackEPSS 1.6%CVE-2025-46727HIGHUnbounded-Parameter DoS in Rack::QueryParserEPSS 1.2%CVE-2025-25184MEDIUMPossible Log Injection in Rack::CommonLoggerEPSS 1.2%