Read the docs
TI-2025-37269 Aliases CVE-2025-59830GHSA-625h-95r8-8xpm

Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters

Priority MEDIUM 40CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 21 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00573 47th percentileScored 2026-11-07
Fix Partial rack (rack): 2.2.18rack (RubyGems): 2.2.18Red Hat: 14 advisoriesRed Hat: 21 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rackrackbefore 2.2.182.2.18Patch availableCNA
—rack (RubyGems)before 2.2.182.2.18Patch availableGHSA-625h-95r8-8xpm
  • rack Vendorrack Affected before 2.2.18 Fixed in 2.2.18 Patch available CNA
  • rack (RubyGems) Vendor— Affected before 2.2.18 Fixed in 2.2.18 Patch available GHSA-625h-95r8-8xpm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*before 2.2.18Vulnerablerack
  • cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:* Versions before 2.2.18 Vulnerable ·rack

Remediation

  • Fix · CNA rack (rack) Fixed in 2.2.18
  • Fix · GHSA-625h-95r8-8xpm rack (RubyGems) Fixed in 2.2.18 Advisory →

Red Hat 14 advisories

  • RHSA-2025:21036 Released 2025-11-11 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 10) cockpit-ha-cluster-0.12.1-1.el10_1.1, pcs-0.12.1-1.el10_1.1, pcs-snmp-0.12.1-1.el10_1.1
  • RHSA-2025:20962 Released 2025-11-11 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 9) pcs-0.11.10-1.el9_7.1, pcs-snmp-0.11.10-1.el9_7.1
    • Red Hat Enterprise Linux Resilient Storage (v. 9) pcs-0.11.10-1.el9_7.1, pcs-snmp-0.11.10-1.el9_7.1
  • RHSA-2025:19948 Released 2025-11-10 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) pcs-0.10.8-1.el8_4.8, pcs-snmp-0.10.8-1.el8_4.8
    • Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) pcs-0.10.8-1.el8_4.8, pcs-snmp-0.10.8-1.el8_4.8
Show 11 more Red Hat advisories
  • RHSA-2025:19856 Released 2025-11-06 · Red Hat rating Important
    Satellite 6.15.5.6 Async Update
    • Red Hat Satellite 6.15 for RHEL 8 foreman-3.9.1.13-1.el8sat, foreman-cli-3.9.1.13-1.el8sat, foreman-debug-3.9.1.13-1.el8sat +13
  • RHSA-2025:19855 Released 2025-11-06 · Red Hat rating Important
    Satellite 6.16.5.5 Async Update
    • Red Hat Satellite 6.16 for RHEL 8 foreman-3.12.0.11-1.el8sat, foreman-cli-3.12.0.11-1.el8sat, foreman-debug-3.12.0.11-1.el8sat +13
    • Red Hat Satellite 6.16 for RHEL 9 foreman-3.12.0.11-1.el9sat, foreman-cli-3.12.0.11-1.el9sat, foreman-debug-3.12.0.11-1.el9sat +13
  • RHSA-2025:19832 Released 2025-11-05 · Red Hat rating Important
    Satellite 6.17.6 Async Update
    • Red Hat Satellite 6.17 for RHEL 9 foreman-3.14.0.10-1.el9sat, foreman-cli-3.14.0.10-1.el9sat, foreman-debug-3.14.0.10-1.el9sat +13
  • RHSA-2025:19800 Released 2025-11-05 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.9.0) pcs-0.11.1-10.el9_0.9, pcs-snmp-0.11.1-10.el9_0.9
    • Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) pcs-0.11.1-10.el9_0.9, pcs-snmp-0.11.1-10.el9_0.9
  • RHSA-2025:19736 Released 2025-11-04 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability EUS (v.9.4) pcs-0.11.7-2.el9_4.5, pcs-snmp-0.11.7-2.el9_4.5
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.4) pcs-0.11.7-2.el9_4.5, pcs-snmp-0.11.7-2.el9_4.5
  • RHSA-2025:19734 Released 2025-11-04 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.6) pcs-0.10.12-6.el8_6.10, pcs-snmp-0.10.12-6.el8_6.10
    • Red Hat Enterprise Linux High Availability TUS (v.8.6) pcs-0.10.12-6.el8_6.10, pcs-snmp-0.10.12-6.el8_6.10
  • RHSA-2025:19733 Released 2025-11-04 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.9.2) pcs-0.11.4-7.el9_2.6, pcs-snmp-0.11.4-7.el9_2.6
    • Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) pcs-0.11.4-7.el9_2.6, pcs-snmp-0.11.4-7.el9_2.6
  • RHSA-2025:19719 Released 2025-11-04 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux HighAvailability (v. 8) pcs-0.10.18-2.el8_10.7, pcs-snmp-0.10.18-2.el8_10.7
    • Red Hat Enterprise Linux ResilientStorage (v. 8) pcs-0.10.18-2.el8_10.7, pcs-snmp-0.10.18-2.el8_10.7
  • RHSA-2025:19647 Released 2025-11-04 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.8) pcs-0.10.15-4.el8_8.9, pcs-snmp-0.10.15-4.el8_8.9
    • Red Hat Enterprise Linux High Availability TUS (v.8.8) pcs-0.10.15-4.el8_8.9, pcs-snmp-0.10.15-4.el8_8.9
  • RHSA-2025:19512 Released 2025-11-03 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 9) pcs-0.11.9-2.el9_6.2, pcs-snmp-0.11.9-2.el9_6.2
    • Red Hat Enterprise Linux Resilient Storage (v. 9) pcs-0.11.9-2.el9_6.2, pcs-snmp-0.11.9-2.el9_6.2
  • RHSA-2025:19513 Released 2025-11-03 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 10) cockpit-ha-cluster-0.12.0-3.el10_0.3, pcs-0.12.0-3.el10_0.3, pcs-snmp-0.12.0-3.el10_0.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 2AffectedNo fix planned: Out of support scope
Red Hat 3scale API Management Platform 2AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux High Availability (v. 10)Fixed RHSA-2025:19513, RHSA-2025:21036
Red Hat Enterprise Linux High Availability (v. 9)Fixed RHSA-2025:19512, RHSA-2025:20962
Red Hat Enterprise Linux High Availability AUS (v.8.4)Fixed RHSA-2025:19948
Red Hat Enterprise Linux High Availability E4S (v.8.6)Fixed RHSA-2025:19734
Red Hat Enterprise Linux High Availability E4S (v.8.8)Fixed RHSA-2025:19647
Red Hat Enterprise Linux High Availability E4S (v.9.0)Fixed RHSA-2025:19800
Red Hat Enterprise Linux High Availability E4S (v.9.2)Fixed RHSA-2025:19733
Red Hat Enterprise Linux High Availability EUS (v.9.4)Fixed RHSA-2025:19736
Red Hat Enterprise Linux High Availability TUS (v.8.6)Fixed RHSA-2025:19734
Red Hat Enterprise Linux High Availability TUS (v.8.8)Fixed RHSA-2025:19647
Red Hat Enterprise Linux HighAvailability (v. 8)Fixed RHSA-2025:19719
Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4)Fixed RHSA-2025:19948
Red Hat Enterprise Linux Resilient Storage (v. 9)Fixed RHSA-2025:19512, RHSA-2025:20962
Red Hat Enterprise Linux Resilient Storage E4S (v.9.2)Fixed RHSA-2025:19733
Red Hat Enterprise Linux Resilient Storage EUS (v.9.4)Fixed RHSA-2025:19736
Red Hat Enterprise Linux ResilientStorage (v. 8)Fixed RHSA-2025:19719
Red Hat Enterprise Linux ResilientStorage E4S (v.9.0)Fixed RHSA-2025:19800
Red Hat Satellite 6.15 for RHEL 8Fixed RHSA-2025:19856
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2025:19855
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2025:19855
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2025:19832
Not affected: 12 products
  • Logging Subsystem for Red Hat OpenShift
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenStack Platform 13 (Queens)
  • Red Hat Satellite 6.15 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59830
  2. 2026-10-03 Alias added: GHSA-625h-95r8-8xpm

References

Patch 1

Advisory 2

Other 1

  • TI-2024-16580 Rack ReDos in content type parsing (2nd degree polynomial) CVSS 3.1HIGH 7.5
  • TI-2024-17236 Possible Denial of Service Vulnerability in Rack Header Parsing CVSS 3.1HIGH 7.5
  • TI-2024-17231 Possible DoS Vulnerability with Range Header in Rack CVSS 3.1HIGH 7.5
  • TI-2023-12254 Uncontrolled resource consumption in https://github.com/rack/rack CVSS 3.1HIGH 7.5
  • TI-2025-38165 Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) CVSS 3.1HIGH 7.5
  • TI-2025-38163 Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) CVSS 3.1HIGH 7.5
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences