CVE catalog

CVE-2025-61919

Rack vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.65% · Oct 25, 2026

Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, `Rack::Request#POST` reads the entire request body into memory for `Content-Type: application/x-www-form-urlencoded`, calling `rack.input.read(nil)` without enforcing a length or cap. Large request bodies can therefore be buffered completely into process memory before parsing, leading to denial of service (DoS) through memory exhaustion. Users should upgrade to Rack version 2.2.20, 3.1.18, or 3.2.3, anu of which enforces form parameter limits using `query_parser.bytesize_limit`, preventing unbounded reads of `application/x-www-form-urlencoded` bodies. Additionally, enforce strict maximum body size at the proxy or web server layer (e.g., Nginx `client_max_body_size`, Apache `LimitRequestBody`).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-racksid3.2.7-1fixed
Debianruby-rackforky3.2.7-1fixed
Debianruby-racktrixie3.1.20-0+deb13u1fixed
Debianruby-racktrixie-security3.1.20-0+deb13u2fixed
Debianruby-rackbookworm2.2.22-0+deb12u1fixed
Debianruby-rackbookworm-security2.2.22-0+deb12u2fixed
Ubunturuby-racknoble2.2.7-1ubuntu0.5fixed
CperackNot reported3.2.3fixed
Ubunturuby-rackpro2.0.6-3vulnerable
Ubunturuby-rackpro2.0.7-2vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm1vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm2vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm3vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm4vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm5vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm6vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm7vulnerable
Ubunturuby-rackpro2.0.7-2ubuntu0.1+esm8fixed
Ubunturuby-rack22.042.1.4-3vulnerable
Ubunturuby-rack22.042.1.4-4vulnerable
Ubunturuby-rack22.042.1.4-5vulnerable
Ubunturuby-rack22.042.1.4-5ubuntu1vulnerable
Ubunturuby-rack22.042.1.4-5ubuntu1.1vulnerable
Ubunturuby-rack22.042.1.4-5ubuntu1.2fixed
Ubunturuby-rack24.042.2.4-3vulnerable
Ubunturuby-rack24.042.2.7-1vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.1vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.2vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.3vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.4vulnerable
Ubunturuby-rack24.042.2.7-1ubuntu0.5fixed
Ubunturuby-rack25.102.2.7-1.1vulnerable
Ubunturuby-rack25.103.1.16-0.1vulnerable
Ubunturuby-rack25.103.1.16-0.1ubuntu0.1fixed
Opensuserubygem-rack-2.2tumbleweed2.2.20-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-racksourcesid3.1.18-1not yet assignedNot reported[1117856]
Debianruby-racksourceforky3.1.18-1not yet assignedNot reported[1117856]
Debianruby-racksourcetrixie3.1.18-1~deb13u1not yet assignedNot reported[1117856]
Debianruby-racksourcebookworm2.2.20-0+deb12u1not yet assignedNot reported[1117856]
Ubunturuby-rackdebnoble2.2.7-1ubuntu0.5Not reportedNot reportedNot reported
CperackcpeNot reported3.2.3Not reportedNVD-CVE-2025-61919Not reported
Ubunturuby-rackdebpro2.0.7-2ubuntu0.1+esm8Not reportedUBUNTU-CVE-2025-61919Not reported
Ubunturuby-rackdeb22.042.1.4-5ubuntu1.2Not reportedUBUNTU-CVE-2025-61919Not reported
Ubunturuby-rackdeb24.042.2.7-1ubuntu0.5Not reportedUBUNTU-CVE-2025-61919Not reported
Ubunturuby-rackdeb25.103.1.16-0.1ubuntu0.1Not reportedUBUNTU-CVE-2025-61919Not reported
Opensuserubygem-rack-2.2rpmtumbleweed2.2.20-1.1Not reportedOPENSUSE-SU-2025:15642-1Not reported

[Debian bug #1117856]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [ruby4.0-rubygem-rack-2.2]Unknown

    Source package: [rubygem-rack-2.2]

    Details (1)

    • 2.2.23-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.2.20-1.1

      Version impact unknown

      usn · rubygem-rack-2.2 · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [ruby-rack]Fixed
    Details (4)

    • 2.2.22-0+deb12u1 · all · bookworm

      Fixed · Fixed: 2.2.20-0+deb12u1

      usn · ruby-rack · debian · bookworm; usn · ruby-rack · debian · 12

    • 2.2.22-0+deb12u1 · all · bookworm

      Fixed · Fixed: 2.2.20-0+deb12u1

      usn · ruby-rack · debian · bookworm; usn · ruby-rack · debian · 12

    • 2.2.22-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 2.2.20-0+deb12u1

      usn · ruby-rack · debian · bookworm; usn · ruby-rack · debian · 12

    • 2.2.22-0+deb12u2 · all · bookworm-security

      Fixed · Fixed: 2.2.20-0+deb12u1

      usn · ruby-rack · debian · bookworm; usn · ruby-rack · debian · 12

[Debian 13 (Trixie)]

  • [ruby-rack]Fixed
    Details (5)

    • 3.1.20-0+deb13u1 · all · trixie

      Fixed · Fixed: 3.1.18-1~deb13u1

      usn · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie

      Fixed · Fixed: 3.1.18-1~deb13u1

      usn · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 3.1.18-1~deb13u1

      usn · ruby-rack · debian · 13

    • 3.1.20-0+deb13u1 · all · trixie-security · Historical version

      Fixed · Fixed: 3.1.18-1~deb13u1

      usn · ruby-rack · debian · 13

    • 3.1.20-0+deb13u2 · all · trixie-security

      Fixed · Fixed: 3.1.18-1~deb13u1

      usn · ruby-rack · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]