CVE-2025-59830: rack Uncontrolled Resource Consumption

Vulnerability summary

CVE-2025-59830 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in rack. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46.3% of scored vulnerabilities.

Timeline

1. 25-09-2025
   PublishedVulnerability first disclosed.
2. 25-09-2025
   Last modifiedVulnerability information updated.

Description

Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.