Memory Exhaustion Vulnerability in Rack Web Server Interface
CVE-2025-61772
What is CVE-2025-61772?
The Rack web server interface has a vulnerability in its Rack::Multipart::Parser component, which can lead to memory exhaustion. When multipart part headers do not terminate as required, the parser allows unlimited data accumulation. This unbounded data storage can be exploited by remote attackers sending incomplete multipart headers, leading to excessive memory consumption, process termination, or significant slowdowns in applications handling these uploads. Versions 2.2.19, 3.1.17, and 3.2.2 have implemented restrictions on header sizes to mitigate this issue, making it crucial for all users of previous versions to upgrade or manage request size limits effectively.
Affected Version(s)
rack < 2.2.19 < 2.2.19
rack >= 3.1, < 3.1.17 < 3.1, 3.1.17
rack >= 3.2, < 3.2.2 < 3.2, 3.2.2