CVE catalog

CVE-2025-61772

Rack vulnerabilities

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Oct 7, 2025, 3:02:09 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.93% · Oct 25, 2026

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (`CRLFCRLF`). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected. Versions 2.2.19, 3.1.17, and 3.2.2 cap per-part header size (e.g., 64 KiB). As a workaround, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx `client_max_body_size`).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	ruby-rack	sid	`3.2.7-1`	fixed
Debian	ruby-rack	forky	`3.2.7-1`	fixed
Debian	ruby-rack	trixie	`3.1.20-0+deb13u1`	fixed
Debian	ruby-rack	trixie-security	`3.1.20-0+deb13u2`	fixed
Debian	ruby-rack	bookworm	`2.2.22-0+deb12u1`	fixed
Debian	ruby-rack	bookworm-security	`2.2.22-0+deb12u2`	fixed
Ubuntu	ruby-rack	noble	`2.2.7-1ubuntu0.5`	fixed
Cpe	rack	Not reported	`3.2.2`	fixed
Ubuntu	ruby-rack	pro	`2.0.6-3`	vulnerable
Ubuntu	ruby-rack	pro	`2.0.7-2`	vulnerable
Ubuntu	ruby-rack	pro	`2.0.7-2ubuntu0.1`	vulnerable
Ubuntu	ruby-rack	pro	`2.0.7-2ubuntu0.1+esm1`	vulnerable
Ubuntu	ruby-rack	pro	`2.0.7-2ubuntu0.1+esm2`	vulnerable
Ubuntu	ruby-rack	pro	`2.0.7-2ubuntu0.1+esm3`	vulnerable
Ubuntu	ruby-rack	pro	`2.0.7-2ubuntu0.1+esm4`	vulnerable
Ubuntu	ruby-rack	pro	`2.0.7-2ubuntu0.1+esm5`	vulnerable
Ubuntu	ruby-rack	pro	`2.0.7-2ubuntu0.1+esm6`	vulnerable
Ubuntu	ruby-rack	pro	`2.0.7-2ubuntu0.1+esm7`	vulnerable
Ubuntu	ruby-rack	pro	`2.0.7-2ubuntu0.1+esm8`	vulnerable
Ubuntu	ruby-rack	pro	`2.0.7-2ubuntu0.1+esm9`	vulnerable
Ubuntu	ruby-rack	pro	`2.0.7-2ubuntu0.1+esm10`	vulnerable
Ubuntu	ruby-rack	22.04	`2.1.4-3`	vulnerable
Ubuntu	ruby-rack	22.04	`2.1.4-4`	vulnerable
Ubuntu	ruby-rack	22.04	`2.1.4-5`	vulnerable
Ubuntu	ruby-rack	22.04	`2.1.4-5ubuntu1`	vulnerable
Ubuntu	ruby-rack	22.04	`2.1.4-5ubuntu1.1`	vulnerable
Ubuntu	ruby-rack	22.04	`2.1.4-5ubuntu1.2`	fixed
Ubuntu	ruby-rack	24.04	`2.2.4-3`	vulnerable
Ubuntu	ruby-rack	24.04	`2.2.7-1`	vulnerable
Ubuntu	ruby-rack	24.04	`2.2.7-1ubuntu0.1`	vulnerable
Ubuntu	ruby-rack	24.04	`2.2.7-1ubuntu0.2`	vulnerable
Ubuntu	ruby-rack	24.04	`2.2.7-1ubuntu0.3`	vulnerable
Ubuntu	ruby-rack	24.04	`2.2.7-1ubuntu0.4`	vulnerable
Ubuntu	ruby-rack	24.04	`2.2.7-1ubuntu0.5`	fixed
Ubuntu	ruby-rack	25.10	`2.2.7-1.1`	vulnerable
Ubuntu	ruby-rack	25.10	`3.1.16-0.1`	vulnerable
Ubuntu	ruby-rack	25.10	`3.1.16-0.1ubuntu0.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	ruby-rack	source	sid	`3.1.18-1`	not yet assigned	Not reported	[1117627]
Debian	ruby-rack	source	forky	`3.1.18-1`	not yet assigned	Not reported	[1117627]
Debian	ruby-rack	source	trixie	`3.1.18-1~deb13u1`	not yet assigned	Not reported	[1117627]
Debian	ruby-rack	source	bookworm	`2.2.20-0+deb12u1`	not yet assigned	Not reported	[1117627]
Ubuntu	ruby-rack	deb	noble	`2.2.7-1ubuntu0.5`	Not reported	Not reported	Not reported
Cpe	rack	cpe	Not reported	`3.2.2`	Not reported	NVD-CVE-2025-61772	Not reported
Ubuntu	ruby-rack	deb	22.04	`2.1.4-5ubuntu1.2`	Not reported	UBUNTU-CVE-2025-61772	Not reported
Ubuntu	ruby-rack	deb	24.04	`2.2.7-1ubuntu0.5`	Not reported	UBUNTU-CVE-2025-61772	Not reported
Ubuntu	ruby-rack	deb	25.10	`3.1.16-0.1ubuntu0.1`	Not reported	UBUNTU-CVE-2025-61772	Not reported

[Debian bug #1117627]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[ruby-rack]Fixed
Details (4)
- 2.2.22-0+deb12u1 · all · bookworm
  Fixed · Fixed: 2.2.20-0+deb12u1
  usn · ruby-rack · debian · bookworm; usn · ruby-rack · debian · 12
- 2.2.22-0+deb12u1 · all · bookworm
  Fixed · Fixed: 2.2.20-0+deb12u1
  usn · ruby-rack · debian · bookworm; usn · ruby-rack · debian · 12
- 2.2.22-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 2.2.20-0+deb12u1
  usn · ruby-rack · debian · bookworm; usn · ruby-rack · debian · 12
- 2.2.22-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 2.2.20-0+deb12u1
  usn · ruby-rack · debian · bookworm; usn · ruby-rack · debian · 12

[Debian 13 (Trixie)]

[ruby-rack]Fixed
Details (5)
- 3.1.20-0+deb13u1 · all · trixie
  Fixed · Fixed: 3.1.18-1~deb13u1
  usn · ruby-rack · debian · 13
- 3.1.20-0+deb13u1 · all · trixie
  Fixed · Fixed: 3.1.18-1~deb13u1
  usn · ruby-rack · debian · 13
- 3.1.20-0+deb13u1 · all · trixie-security
  Fixed · Fixed: 3.1.18-1~deb13u1
  usn · ruby-rack · debian · 13
- 3.1.20-0+deb13u1 · all · trixie-security · Historical version
  Fixed · Fixed: 3.1.18-1~deb13u1
  usn · ruby-rack · debian · 13
- 3.1.20-0+deb13u2 · all · trixie-security
  Fixed · Fixed: 3.1.18-1~deb13u1
  usn · ruby-rack · debian · 13

Observed: Oct 27, 2026, 11:33:31 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]