CVE catalog

CVE-2025-61770

Rack vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.93% · Oct 25, 2026

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` buffers the entire multipart preamble (bytes before the first boundary) in memory without any size limit. A client can send a large preamble followed by a valid boundary, causing significant memory use and potential process termination due to out-of-memory (OOM) conditions. Remote attackers can trigger large transient memory spikes by including a long preamble in multipart/form-data requests. The impact scales with allowed request sizes and concurrency, potentially causing worker crashes or severe slowdown due to garbage collection. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a preamble size limit (e.g., 16 KiB) or discard preamble data entirely. Workarounds include limiting total request body size at the proxy or web server level and monitoring memory and set per-process limits to prevent OOM conditions.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-racksid3.2.7-1fixed
Debianruby-rackforky3.2.7-1fixed
Debianruby-racktrixie3.1.20-0+deb13u1fixed
Debianruby-racktrixie-security3.1.20-0+deb13u2fixed
Debianruby-rackbookworm2.2.22-0+deb12u1fixed
Debianruby-rackbookworm-security2.2.22-0+deb12u2fixed
Ubunturuby-racknoble2.2.7-1ubuntu0.5fixed
CperackNot reported3.2.2fixed
Ubunturuby-rackpro2.0.6-3vulnerable
Ubunturuby-rackpro2.0.7-2vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm1vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm2vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm3vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm4vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm5vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm6vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm7vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm8vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm9vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm10vulnerable
Ubunturuby-rack22.042.1.4-3vulnerable
Ubunturuby-rack22.042.1.4-4vulnerable
Ubunturuby-rack22.042.1.4-5vulnerable
Ubunturuby-rack22.042.1.4-5ubuntu1vulnerable
Ubunturuby-rack22.042.1.4-5ubuntu1.1vulnerable
Ubunturuby-rack22.042.1.4-5ubuntu1.2fixed
Ubunturuby-rack24.042.2.4-3vulnerable
Ubunturuby-rack24.042.2.7-1vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.1vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.2vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.3vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.4vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.5fixed
Ubunturuby-rack25.102.2.7-1.1vulnerable
Ubunturuby-rack25.103.1.16-0.1vulnerable
Ubunturuby-rack25.103.1.16-0.1ubuntu0.1fixed
Opensuserubygem-rack-2.2tumbleweed2.2.19-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-racksourcesid3.1.18-1not yet assignedNot reported[1117627]
Debianruby-racksourceforky3.1.18-1not yet assignedNot reported[1117627]
Debianruby-racksourcetrixie3.1.18-1~deb13u1not yet assignedNot reported[1117627]
Debianruby-racksourcebookworm2.2.20-0+deb12u1not yet assignedNot reported[1117627]
Ubunturuby-rackdebnoble2.2.7-1ubuntu0.5Not reportedNot reportedNot reported
CperackcpeNot reported3.2.2Not reportedNVD-CVE-2025-61770Not reported
Ubunturuby-rackdeb22.042.1.4-5ubuntu1.2Not reportedUBUNTU-CVE-2025-61770Not reported
Ubunturuby-rackdeb24.042.2.7-1ubuntu0.5Not reportedUBUNTU-CVE-2025-61770Not reported
Ubunturuby-rackdeb25.103.1.16-0.1ubuntu0.1Not reportedUBUNTU-CVE-2025-61770Not reported
Opensuserubygem-rack-2.2rpmtumbleweed2.2.19-1.1Not reportedOPENSUSE-SU-2025:15621-1Not reported

[Debian bug #1117627]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [ruby4.0-rubygem-rack-2.2]Unknown

    Source package: [rubygem-rack-2.2]

    Details (1)

    • 2.2.23-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.2.19-1.1

      Version impact unknown

      usn · rubygem-rack-2.2 · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [ruby-rack]Fixed
    Details (4)

    • 2.2.22-0+deb12u1 · all · bookworm

      Fixed · Fixed: 2.2.20-0+deb12u1

      usn · ruby-rack · debian · bookworm; usn · ruby-rack · debian · 12

    • 2.2.22-0+deb12u1 · all · bookworm

      Fixed · Fixed: 2.2.20-0+deb12u1

      usn · ruby-rack · debian · bookworm; usn · ruby-rack · debian · 12

    • 2.2.22-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 2.2.20-0+deb12u1

      usn · ruby-rack · debian · bookworm; usn · ruby-rack · debian · 12

    • 2.2.22-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 2.2.20-0+deb12u1

      usn · ruby-rack · debian · bookworm; usn · ruby-rack · debian · 12

[Debian 13 (Trixie)]

  • [ruby-rack]Fixed
    Details (5)

    • 3.1.20-0+deb13u1 · all · trixie

      Fixed · Fixed: 3.1.18-1~deb13u1

      usn · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie

      Fixed · Fixed: 3.1.18-1~deb13u1

      usn · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 3.1.18-1~deb13u1

      usn · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 3.1.18-1~deb13u1

      usn · ruby-rack · debian · 13

    • 3.1.20-0+deb13u2 · all · trixie-security

      Fixed · Fixed: 3.1.18-1~deb13u1

      usn · ruby-rack · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]