CVE-2025-61919

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.20 Rack versions prior to 3.1.18 Rack versions prior to 3.2.3

Description Rack is a modular Ruby web server interface. In versions prior to 2.2.20, 3.1.18, and 3.2.3, the Rack::Request#POST method reads the entire request body into memory when handling Content-Type: application/x-www-form-urlencoded requests without enforcing a length or cap. This can lead to a denial of service (DoS) through memory exhaustion if an attacker sends a large request body. The vulnerable code calls rack.input.read(nil) which allows unbounded reads of application/x-www-form-urlencoded bodies.

Recommendations Upgrade to Rack version 2.2.20 to address the issue. Upgrade to Rack version 3.1.18 to address the issue. Upgrade to Rack version 3.2.3 to address the issue. Enforce strict maximum body size at the proxy or web server layer, such as using client max body size in Nginx or LimitRequestBody in Apache.