{"cve":"CVE-2025-61919","nvd":{"published":"2025-10-10T20:15:37.730","modified":"2026-10-19T16:10:00.260","status":"Analyzed","description":"Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, `Rack::Request#POST` reads the entire request body into memory for `Content-Type: application/x-www-form-urlencoded`, calling `rack.input.read(nil)` without enforcing a length or cap. Large request bodies can therefore be buffered completely into process memory before parsing, leading to denial of service (DoS) through memory exhaustion. Users should upgrade to Rack version 2.2.20, 3.1.18, or 3.2.3, anu of which enforces form parameter limits using `query_parser.bytesize_limit`, preventing unbounded reads of `application/x-www-form-urlencoded` bodies. Additionally, enforce strict maximum body size at the proxy or web server layer (e.g., Nginx `client_max_body_size`, Apache `LimitRequestBody`).","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-400"],"references":["https://github.com/rack/rack/commit/4e2c903991a790ee211a3021808ff4fd6fe82881","https://github.com/rack/rack/commit/cbd541e8a3d0c5830a3c9a30d3718ce2e124f9db","https://github.com/rack/rack/commit/e179614c4a653283286f5f046428cbb85f21146f","https://github.com/rack/rack/security/advisories/GHSA-6xw4-3v39-52mm"],"products":["rack:rack"],"source":"nvd","synced_at":"2026-10-19T22:11:26.888974865+00:00"},"epss":{"cve":"CVE-2025-61919","score":0.00648,"percentile":0.50783,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-6xw4-3v39-52mm","url":"https://osv.dev/vulnerability/GHSA-6xw4-3v39-52mm","summary":"Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing","modified":"2026-09-10T03:50:29.392401482Z","packages":[{"ecosystem":"RubyGems","name":"rack","purl":"pkg:gem/rack","ranges":["<2.2.20"],"fixed":["2.2.20"]},{"ecosystem":"RubyGems","name":"rack","purl":"pkg:gem/rack","ranges":[">=3.0 <3.1.18"],"fixed":["3.1.18"]},{"ecosystem":"RubyGems","name":"rack","purl":"pkg:gem/rack","ranges":[">=3.2 <3.2.3"],"fixed":["3.2.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}