CVE-2025-61772

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.19 Rack versions prior to 3.1.17 Rack versions prior to 3.2.2

Description Rack is a modular Ruby web server interface. The Rack::Multipart::Parser component can accumulate unbounded data when processing multipart requests with incomplete header blocks that lack the required blank line. This allows a remote attacker to exhaust memory, potentially leading to a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory usage, resulting in process termination or significant performance degradation. The impact is proportional to request size limits and concurrency. Applications handling multipart uploads may be affected. The parser keeps appending incoming bytes to memory without a size cap.

Recommendations Update to Rack version 2.2.19 or later. Update to Rack version 3.1.17 or later. Update to Rack version 3.2.2 or later. As a workaround, restrict maximum request sizes at the proxy or web server layer.