CVE-2025-59830

Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/rack/rack/commit/54e4ffdd5affebcb0c015cc6ae74635c0831ed71	Patch
https://github.com/rack/rack/security/advisories/GHSA-625h-95r8-8xpm	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*

History

19 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Rack es una interfaz modular de servidor web Ruby. Antes de la versión 2.2.18, Rack::QueryParser aplica su límite de parámetros solo para los parámetros separados por '&', mientras que sigue dividiendo tanto por '&' como por ';'. Como resultado, los atacantes podrían usar separadores ';' para eludir el límite de recuento de parámetros y enviar más parámetros de los previstos. Las aplicaciones o el middleware que invocan directamente a Rack::QueryParser con su configuración predeterminada (sin delimitador explícito) podrían estar expuestas a un mayor consumo de CPU y memoria. Esto puede ser explotado como un vector limitado de denegación de servicio. Este problema ha sido parcheado en la versión 2.2.18.

Information

Published : 2025-09-25 15:16

Updated : 2026-10-19 16:10

NVD link : CVE-2025-59830

Mitre link : CVE-2025-59830

CVE.ORG link : CVE-2025-59830

JSON object : View

Products Affected

rack

rack

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2025-59830", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59830", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-25T16:14:17.653996Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "rack", "product": "rack", "versions": [{"status": "affected", "version": "< 2.2.18"}]}]}], "published": "2025-09-25T15:16:13.780", "references": [{"url": "https://github.com/rack/rack/commit/54e4ffdd5affebcb0c015cc6ae74635c0831ed71", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/rack/rack/security/advisories/GHSA-625h-95r8-8xpm", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18."}, {"lang": "es", "value": "Rack es una interfaz modular de servidor web Ruby. Antes de la versi\u00f3n 2.2.18, Rack::QueryParser aplica su l\u00edmite de par\u00e1metros solo para los par\u00e1metros separados por '&', mientras que sigue dividiendo tanto por '&' como por ';'. Como resultado, los atacantes podr\u00edan usar separadores ';' para eludir el l\u00edmite de recuento de par\u00e1metros y enviar m\u00e1s par\u00e1metros de los previstos. Las aplicaciones o el middleware que invocan directamente a Rack::QueryParser con su configuraci\u00f3n predeterminada (sin delimitador expl\u00edcito) podr\u00edan estar expuestas a un mayor consumo de CPU y memoria. Esto puede ser explotado como un vector limitado de denegaci\u00f3n de servicio. Este problema ha sido parcheado en la versi\u00f3n 2.2.18."}], "lastModified": "2026-10-19T16:10:00.260", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*", "vulnerable": true, "matchCriteriaId": "737F4C76-9502-4F37-AB65-0124F1CD72BF", "versionEndExcluding": "2.2.18"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}