Denial of Service Vulnerability in Rack Web Server Interface
CVE-2025-61771
7.5HIGH
What is CVE-2025-61771?
The Rack web server interface experiences a vulnerability where non-file multipart form fields are stored in memory. This can lead to excessive memory usage when handling large text fields, resulting in potential out-of-memory conditions. Attackers can exploit this by sending oversized fields, leading to denial of service as worker processes may crash or be impeded by high garbage-collection overhead. Versions 2.2.19, 3.1.17, and 3.2.2 introduce safeguards to limit the size of non-file fields, which can mitigate this issue. To protect applications, it is advised to enforce maximum request body sizes and validate input at the application level.
Affected Version(s)
rack < 2.2.19 < 2.2.19
rack >= 3.1, < 3.1.17 < 3.1, 3.1.17
rack >= 3.2, < 3.2.2 < 3.2, 3.2.2