Read the docs
TI-2025-29398 Aliases CVE-2025-46727GHSA-gjh7-p2fx-99vx

Unbounded-Parameter DoS in Rack::QueryParser

Priority MEDIUM 41CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 24 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, `Rack::QueryParser` parses query strings and `application/x-www-form-urlencoded` bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with extremely large numbers of parameters. The vulnerability arises because `Rack::QueryParser` iterates over each `&`-separated key-value pair and adds it to a Hash without enforcing an upper bound on the total number of parameters. This allows an attacker to send a single request containing hundreds of thousands (or more) of parameters, which consumes excessive memory and CPU during parsing. An attacker can trigger denial of service by sending specifically crafted HTTP requests, which can cause memory exhaustion or pin CPU resources, stalling or crashing the Rack server. This results in full service disruption until the affected worker is restarted. Versions 2.2.14, 3.0.16, and 3.1.14 fix the issue. Some other mitigations are available. One may use middleware to enforce a maximum query string size or parameter count, or employ a reverse proxy (such as Nginx) to limit request sizes and reject oversized query strings or bodies. Limiting request body sizes and query string lengths at the web server or CDN level is an effective mitigation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01228 69th percentileScored 2026-11-07
Fix Partial rack (rack): 2.2.14, 3.0.16, 3.1.14rack (RubyGems): 2.2.14, 3.0.16, 3.1.14Red Hat: 13 advisoriesRed Hat: 24 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rackrackbefore 2.2.14; 3.0 to before 3.0.16; 3.1 to before 3.1.142.2.14, 3.0.16, 3.1.14Patch availableCNA
—rack (RubyGems)before 2.2.142.2.14Patch availableGHSA-gjh7-p2fx-99vx
—rack (RubyGems)3.0 to before 3.0.163.0.16Patch availableGHSA-gjh7-p2fx-99vx
—rack (RubyGems)3.1 to before 3.1.143.1.14Patch availableGHSA-gjh7-p2fx-99vx
  • rack Vendorrack Affected before 2.2.14; 3.0 to before 3.0.16; 3.1 to before 3.1.14 Fixed in 2.2.14, 3.0.16, 3.1.14 Patch available CNA
  • rack (RubyGems) Vendor— Affected before 2.2.14 Fixed in 2.2.14 Patch available GHSA-gjh7-p2fx-99vx
  • rack (RubyGems) Vendor— Affected 3.0 to before 3.0.16 Fixed in 3.0.16 Patch available GHSA-gjh7-p2fx-99vx
  • rack (RubyGems) Vendor— Affected 3.1 to before 3.1.14 Fixed in 3.1.14 Patch available GHSA-gjh7-p2fx-99vx

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*before 2.2.14Vulnerablerack
cpe:2.3:a:rack:rack:*:-:*:*:*:ruby:*:*3.0.0 to before 3.0.16; 3.1.0 to before 3.1.14Vulnerablerack
  • cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:* Versions before 2.2.14 Vulnerable ·rack
  • cpe:2.3:a:rack:rack:*:-:*:*:*:ruby:*:* Versions 3.0.0 to before 3.0.16; 3.1.0 to before 3.1.14 Vulnerable ·rack

Remediation

  • Fix · CNA rack (rack) Fixed in 2.2.14, 3.0.16, 3.1.14
  • Fix · GHSA-gjh7-p2fx-99vx rack (RubyGems) Fixed in 2.2.14 Advisory →
  • Fix · GHSA-gjh7-p2fx-99vx rack (RubyGems) Fixed in 3.0.16 Advisory →
  • Fix · GHSA-gjh7-p2fx-99vx rack (RubyGems) Fixed in 3.1.14 Advisory →

Red Hat 13 advisories

  • RHSA-2025:9838 Released 2025-06-26 · Red Hat rating Moderate
    Satellite 6.15.5.3 Async Update
    • Red Hat Satellite 6.15 for RHEL 8 cjson-1.7.18-1.el8sat, python-sqlparse-0.5.0-1.el8pc, python3.11-sqlparse-0.5.0-1.el8pc +1
  • RHSA-2025:8323 Released 2025-05-29 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) pcs-0.10.8-1.el8_4.7, pcs-snmp-0.10.8-1.el8_4.7
    • Red Hat Enterprise Linux HighAvailability E4S (v.8.4) pcs-0.10.8-1.el8_4.7, pcs-snmp-0.10.8-1.el8_4.7
    • Red Hat Enterprise Linux HighAvailability TUS (v.8.4) pcs-0.10.8-1.el8_4.7, pcs-snmp-0.10.8-1.el8_4.7
  • RHSA-2025:8322 Released 2025-05-29 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux Server HighAvailability (v. 7 ELS) pcs-0.9.169-3.el7_9.4, pcs-snmp-0.9.169-3.el7_9.4
    • Red Hat Enterprise Linux Server ResilientStorage (v. 7 ELS) pcs-0.9.169-3.el7_9.4, pcs-snmp-0.9.169-3.el7_9.4
Show 10 more Red Hat advisories
  • RHSA-2025:8319 Released 2025-05-29 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 10) cockpit-ha-cluster-0.12.0-3.el10_0.2, pcs-0.12.0-3.el10_0.2, pcs-snmp-0.12.0-3.el10_0.2
  • RHSA-2025:8288 Released 2025-05-29 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS (v.9.4) pcs-0.11.7-2.el9_4.4, pcs-snmp-0.11.7-2.el9_4.4
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.4) pcs-0.11.7-2.el9_4.4, pcs-snmp-0.11.7-2.el9_4.4
  • RHSA-2025:8289 Released 2025-05-29 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS (v.9.2) pcs-0.11.4-7.el9_2.5, pcs-snmp-0.11.4-7.el9_2.5
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.2) pcs-0.11.4-7.el9_2.5, pcs-snmp-0.11.4-7.el9_2.5
  • RHSA-2025:8291 Released 2025-05-29 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.9.0) pcs-0.11.1-10.el9_0.8, pcs-snmp-0.11.1-10.el9_0.8
    • Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) pcs-0.11.1-10.el9_0.8, pcs-snmp-0.11.1-10.el9_0.8
  • RHSA-2025:8290 Released 2025-05-29 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.6) pcs-0.10.12-6.el8_6.8, pcs-snmp-0.10.12-6.el8_6.8
    • Red Hat Enterprise Linux High Availability TUS (v.8.6) pcs-0.10.12-6.el8_6.8, pcs-snmp-0.10.12-6.el8_6.8
  • RHSA-2025:8279 Released 2025-05-28 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS (v.8.8) pcs-0.10.15-4.el8_8.6, pcs-snmp-0.10.15-4.el8_8.6
    • Red Hat Enterprise Linux Resilient Storage EUS (v.8.8) pcs-0.10.15-4.el8_8.6, pcs-snmp-0.10.15-4.el8_8.6
  • RHSA-2025:8256 Released 2025-05-28 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 9) pcs-0.11.9-2.el9_6.1, pcs-snmp-0.11.9-2.el9_6.1
    • Red Hat Enterprise Linux Resilient Storage (v. 9) pcs-0.11.9-2.el9_6.1, pcs-snmp-0.11.9-2.el9_6.1
  • RHSA-2025:8254 Released 2025-05-28 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux HighAvailability (v. 8) pcs-0.10.18-2.el8_10.5, pcs-snmp-0.10.18-2.el8_10.5
    • Red Hat Enterprise Linux ResilientStorage (v. 8) pcs-0.10.18-2.el8_10.5, pcs-snmp-0.10.18-2.el8_10.5
  • RHSA-2025:7605 Released 2025-05-14 · Red Hat rating Important
    Satellite 6.16.5.1 Async Update
    • Red Hat Satellite 6.16 for RHEL 8 rubygem-rack-2.2.14-1.el8sat
    • Red Hat Satellite 6.16 for RHEL 9 rubygem-rack-2.2.14-1.el9sat
  • RHSA-2025:7604 Released 2025-05-14 · Red Hat rating Important
    Satellite 6.17.0.1 Async Update
    • Red Hat Satellite 6.17 for RHEL 9 rubygem-rack-2.2.14-1.el9sat

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix yet
Red Hat 3scale API Management Platform 2AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix yet
Red Hat Enterprise Linux High Availability (v. 10)Fixed RHSA-2025:8319
Red Hat Enterprise Linux High Availability (v. 9)Fixed RHSA-2025:8256
Red Hat Enterprise Linux High Availability AUS (v.8.4)Fixed RHSA-2025:8323
Red Hat Enterprise Linux High Availability E4S (v.8.6)Fixed RHSA-2025:8290
Red Hat Enterprise Linux High Availability E4S (v.9.0)Fixed RHSA-2025:8291
Red Hat Enterprise Linux High Availability EUS (v.8.8)Fixed RHSA-2025:8279
Red Hat Enterprise Linux High Availability EUS (v.9.2)Fixed RHSA-2025:8289
Red Hat Enterprise Linux High Availability EUS (v.9.4)Fixed RHSA-2025:8288
Red Hat Enterprise Linux High Availability TUS (v.8.6)Fixed RHSA-2025:8290
Red Hat Enterprise Linux HighAvailability (v. 8)Fixed RHSA-2025:8254
Red Hat Enterprise Linux HighAvailability E4S (v.8.4)Fixed RHSA-2025:8323
Red Hat Enterprise Linux HighAvailability TUS (v.8.4)Fixed RHSA-2025:8323
Red Hat Enterprise Linux Resilient Storage (v. 9)Fixed RHSA-2025:8256
Red Hat Enterprise Linux Resilient Storage EUS (v.8.8)Fixed RHSA-2025:8279
Red Hat Enterprise Linux Resilient Storage EUS (v.9.2)Fixed RHSA-2025:8289
Red Hat Enterprise Linux Resilient Storage EUS (v.9.4)Fixed RHSA-2025:8288
Red Hat Enterprise Linux ResilientStorage (v. 8)Fixed RHSA-2025:8254
Red Hat Enterprise Linux ResilientStorage E4S (v.9.0)Fixed RHSA-2025:8291
Red Hat Enterprise Linux Server HighAvailability (v. 7 ELS)Fixed RHSA-2025:8322
Red Hat Enterprise Linux Server ResilientStorage (v. 7 ELS)Fixed RHSA-2025:8322
Red Hat Satellite 6.15 for RHEL 8Fixed RHSA-2025:9838
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2025:7605
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2025:7605
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2025:7604
Not affected: 4 products
  • Red Hat Satellite 6.15 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-46727
  2. 2026-10-03 Alias added: GHSA-gjh7-p2fx-99vx

References

Patch 3

Advisory 2

Other 2

  • TI-2024-16580 Rack ReDos in content type parsing (2nd degree polynomial) CVSS 3.1HIGH 7.5
  • TI-2024-17236 Possible Denial of Service Vulnerability in Rack Header Parsing CVSS 3.1HIGH 7.5
  • TI-2024-17231 Possible DoS Vulnerability with Range Header in Rack CVSS 3.1HIGH 7.5
  • TI-2023-12254 Uncontrolled resource consumption in https://github.com/rack/rack CVSS 3.1HIGH 7.5
  • TI-2025-38165 Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) CVSS 3.1HIGH 7.5
  • TI-2025-38163 Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) CVSS 3.1HIGH 7.5
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences