CVE-2025-61921

{"id": "CVE-2025-61921", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61921", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-10T20:54:24.202335Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "sinatra", "product": "sinatra", "versions": [{"status": "affected", "version": "< 4.2.0"}]}]}], "published": "2025-10-10T20:15:38.067", "references": [{"url": "https://bugs.ruby-lang.org/issues/19104", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/sinatra/sinatra/issues/2120", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/sinatra/sinatra/pull/1823", "tags": ["Exploit", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/sinatra/sinatra/pull/2121", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/sinatra/sinatra/security/advisories/GHSA-mr3q-g2mv-mr4q", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue."}, {"lang": "es", "value": "Sinatra es un lenguaje de dominio espec\u00edfico para crear aplicaciones web en Ruby. En versiones anteriores a la 4.2.0, existe una vulnerabilidad de denegaci\u00f3n de servicio en el componente de an\u00e1lisis de las cabeceras 'If-Match' e 'If-None-Match' de Sinatra, si se utiliza el m\u00e9todo 'etag' al construir la respuesta. Una entrada cuidadosamente elaborada puede hacer que el an\u00e1lisis de las cabeceras 'If-Match' e 'If-None-Match' en Sinatra tarde una cantidad de tiempo inesperada, lo que podr\u00eda resultar en un vector de ataque de denegaci\u00f3n de servicio. Esta cabecera suele estar implicada en la generaci\u00f3n del valor de la cabecera 'ETag'. Cualquier aplicaci\u00f3n que utilice el m\u00e9todo 'etag' al generar una respuesta se ve afectada. La versi\u00f3n 4.2.0 soluciona el problema."}], "lastModified": "2026-10-19T16:10:00.260", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sinatrarb:sinatra:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "184922C7-D13C-4EC5-8447-78BC78B5F8C6", "versionEndExcluding": "4.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}