CVE-2025-61772: rack Uncontrolled Resource Consumption
Vulnerability summary
CVE-2025-61772 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in rack. EPSS estimates a 0.93% chance of exploitation in the next 30 days, higher than 59.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 16 · Related 6Timeline
- 07-10-2025PublishedVulnerability first disclosed.
- 07-10-2025Last modifiedVulnerability information updated.
Description
Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (`CRLFCRLF`). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected. Versions 2.2.19, 3.1.17, and 3.2.2 cap per-part header size (e.g., 64 KiB). As a workaround, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx `client_max_body_size`).
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · RubygemsEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.93%
Chance of exploitation in the next 30 days
Percentile
60%
Versus all other CVEs
30-day change
0.00 pp
From 0.93% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard50 products
- gitlab-cng-18.2< 18.2.8-r0
- gitlab-logger-18.2< 18.2.8-r0
- gitlab-logger-18.3< 18.3.4-r0
- gitlab-logger-18.4< 18.4.2-r0
- gitlab-rails-ce-18.1< 18.1.6-r13
Wolfi5 products
- gitlab-cng-18.2< 18.2.8-r0
- ruby3.2-rack-2.2< 2.2.22-r0
- ruby3.3-rack-2.2< 2.2.22-r0
- ruby3.4-rack-2.2< 2.2.22-r0
- ruby4.0-rack-2.2< 2.2.22-r0
Debian1 product
- ruby-rack< 2.2.20-0+deb12u1 | < 3.1.18-1~deb13u1 | < 3.1.18-1
Rack1 product
- rack≥ 3.1, < 3.1.17 | ≥ 3.2, < 3.2.2 | < 2.2.19 | ≥ 3.1.0, < 3.1.17 | ≥ 3.2.0, < 3.2.2
RubyGems1 product
- rack< 2.2.19 | ≥ 3.1, < 3.1.17 | ≥ 3.2, < 3.2.2
Ubuntu1 product
- ruby-rackAll versions (No fix recorded) | < 2.1.4-5ubuntu1.2 | < 2.2.7-1ubuntu0.5 | < 3.1.16-0.1ubuntu0.1
6 vendors · 59 products
References
12 links- github.com/rack/rack/security/advisories/GHSA-wpv5-97wm-hp9cX Refsource CONFIRMREPORTAdvisoryWEBMitigationVendor Advisory
Show all 12 references
- github.com/rack/rackPACKAGE