{"cve":"CVE-2025-61770","nvd":{"published":"2025-10-07T15:16:02.950","modified":"2026-10-19T16:10:00.260","status":"Analyzed","description":"Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` buffers the entire multipart preamble (bytes before the first boundary) in memory without any size limit. A client can send a large preamble followed by a valid boundary, causing significant memory use and potential process termination due to out-of-memory (OOM) conditions. Remote attackers can trigger large transient memory spikes by including a long preamble in multipart/form-data requests. The impact scales with allowed request sizes and concurrency, potentially causing worker crashes or severe slowdown due to garbage collection. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a preamble size limit (e.g., 16 KiB) or discard preamble data entirely. Workarounds include limiting total request body size at the proxy or web server level and monitoring memory and set per-process limits to prevent OOM conditions.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-400"],"references":["https://github.com/rack/rack/commit/589127f4ac8b5cf11cf88fb0cd116ffed4d2181e","https://github.com/rack/rack/commit/d869fed663b113b95a74ad53e1b5cae6ab31f29e","https://github.com/rack/rack/commit/e08f78c656c9394d6737c022bde087e0f33336fd","https://github.com/rack/rack/security/advisories/GHSA-p543-xpfm-54cp"],"products":["rack:rack"],"source":"nvd","synced_at":"2026-10-19T22:11:26.888974865+00:00"},"epss":{"cve":"CVE-2025-61770","score":0.0093,"percentile":0.60345,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-p543-xpfm-54cp","url":"https://osv.dev/vulnerability/GHSA-p543-xpfm-54cp","summary":"Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)","modified":"2026-09-10T03:50:30.040266194Z","packages":[{"ecosystem":"RubyGems","name":"rack","purl":"pkg:gem/rack","ranges":["<2.2.19"],"fixed":["2.2.19"]},{"ecosystem":"RubyGems","name":"rack","purl":"pkg:gem/rack","ranges":[">=3.1 <3.1.17"],"fixed":["3.1.17"]},{"ecosystem":"RubyGems","name":"rack","purl":"pkg:gem/rack","ranges":[">=3.2 <3.2.2"],"fixed":["3.2.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}