CVE-2025-61921: sinatra

Vulnerability summary

CVE-2025-61921 is a high (CVSS 7.5) vulnerability in sinatra. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 10-10-2025
   PublishedVulnerability first disclosed.
2. 10-10-2025
   Last modifiedVulnerability information updated.

Description

Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.

• CWE-1333Inefficient Regular Expression ComplexityThe product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.