Denial of Service Vulnerability in Rack Web Server Interface
CVE-2025-61919
What is CVE-2025-61919?
A vulnerability exists in Rack, a Ruby web server interface, where the Rack::Request#POST method reads the entire request body into memory without any size limitations for Content-Type: application/x-www-form-urlencoded. This issue can lead to denial of service due to memory exhaustion, as large request bodies may be fully buffered in memory before being processed. To remediate this vulnerability, users should update to Rack versions 2.2.20, 3.1.18, or 3.2.3, which implement limits on form parameters. Additionally, configuring strict maximum body sizes at the proxy or web server layer (such as Nginx and Apache) is advised to prevent unbounded reads and enhance overall security.
Affected Version(s)
rack < 2.2.20 < 2.2.20
rack >= 3.0, < 3.1.18 < 3.0, 3.1.18
rack >= 3.2, < 3.2.3 < 3.2, 3.2.3