CVE-2025-61771

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.19 Rack versions prior to 3.1.17 Rack versions prior to 3.2.2

Description Rack is a modular Ruby web server interface. The Rack::Multipart::Parser component stores non-file form fields in memory as Ruby String objects. A large text field within a multipart/form-data request can consume significant process memory, potentially leading to out-of-memory (OOM) conditions and denial of service (DoS). Attackers can exploit this by sending requests with large non-file fields, causing excessive memory usage and potentially crashing workers or increasing garbage-collection overhead. All Rack applications processing multipart form submissions are potentially affected.

Recommendations Update to Rack version 2.2.19 or later. Update to Rack version 3.1.17 or later. Update to Rack version 3.2.2 or later. Restrict maximum request body size at the web-server or proxy layer. Validate and reject unusually large form fields at the application level.