Read the docs
TI-2025-38164 Aliases CVE-2025-61771GHSA-w9pc-fmgc-vxvw

Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

Priority MEDIUM 40CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 15 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, ``Rack::Multipart::Parser` stores non-file form fields (parts without a `filename`) entirely in memory as Ruby `String` objects. A single large text field in a multipart/form-data request (hundreds of megabytes or more) can consume equivalent process memory, potentially leading to out-of-memory (OOM) conditions and denial of service (DoS). Attackers can send large non-file fields to trigger excessive memory usage. Impact scales with request size and concurrency, potentially leading to worker crashes or severe garbage-collection overhead. All Rack applications processing multipart form submissions are affected. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a reasonable size cap for non-file fields (e.g., 2 MiB). Workarounds include restricting maximum request body size at the web-server or proxy layer (e.g., Nginx `client_max_body_size`) and validating and rejecting unusually large form fields at the application level.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00561 46th percentileScored 2026-11-07
Fix Partial rack (rack): 2.2.19, 3.1.17, 3.2.2rack (RubyGems): 2.2.19, 3.1.17, 3.2.2Red Hat: 10 advisoriesRed Hat: 15 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rackrackbefore 2.2.19; 3.1 to before 3.1.17; 3.2 to before 3.2.22.2.19, 3.1.17, 3.2.2Patch availableCNA
—rack (RubyGems)before 2.2.192.2.19Patch availableGHSA-w9pc-fmgc-vxvw
—rack (RubyGems)3.1 to before 3.1.173.1.17Patch availableGHSA-w9pc-fmgc-vxvw
—rack (RubyGems)3.2 to before 3.2.23.2.2Patch availableGHSA-w9pc-fmgc-vxvw
  • rack Vendorrack Affected before 2.2.19; 3.1 to before 3.1.17; 3.2 to before 3.2.2 Fixed in 2.2.19, 3.1.17, 3.2.2 Patch available CNA
  • rack (RubyGems) Vendor— Affected before 2.2.19 Fixed in 2.2.19 Patch available GHSA-w9pc-fmgc-vxvw
  • rack (RubyGems) Vendor— Affected 3.1 to before 3.1.17 Fixed in 3.1.17 Patch available GHSA-w9pc-fmgc-vxvw
  • rack (RubyGems) Vendor— Affected 3.2 to before 3.2.2 Fixed in 3.2.2 Patch available GHSA-w9pc-fmgc-vxvw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*before 2.2.19; 3.1.0 to before 3.1.17; 3.2.0 to before 3.2.2Vulnerablerack
  • cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:* Versions before 2.2.19; 3.1.0 to before 3.1.17; 3.2.0 to before 3.2.2 Vulnerable ·rack

Remediation

  • Fix · CNA rack (rack) Fixed in 2.2.19, 3.1.17, 3.2.2
  • Fix · GHSA-w9pc-fmgc-vxvw rack (RubyGems) Fixed in 2.2.19 Advisory →
  • Fix · GHSA-w9pc-fmgc-vxvw rack (RubyGems) Fixed in 3.1.17 Advisory →
  • Fix · GHSA-w9pc-fmgc-vxvw rack (RubyGems) Fixed in 3.2.2 Advisory →

Red Hat 10 advisories

  • RHSA-2025:21696 Released 2025-11-18 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux Server HighAvailability (v. 7 ELS) pcs-0.9.169-3.el7_9.5, pcs-snmp-0.9.169-3.el7_9.5
    • Red Hat Enterprise Linux Server ResilientStorage (v. 7 ELS) pcs-0.9.169-3.el7_9.5, pcs-snmp-0.9.169-3.el7_9.5
  • RHSA-2025:21036 Released 2025-11-11 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 10) cockpit-ha-cluster-0.12.1-1.el10_1.1, pcs-0.12.1-1.el10_1.1, pcs-snmp-0.12.1-1.el10_1.1
  • RHSA-2025:20962 Released 2025-11-11 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 9) pcs-0.11.10-1.el9_7.1, pcs-snmp-0.11.10-1.el9_7.1
    • Red Hat Enterprise Linux Resilient Storage (v. 9) pcs-0.11.10-1.el9_7.1, pcs-snmp-0.11.10-1.el9_7.1
Show 7 more Red Hat advisories
  • RHSA-2025:19948 Released 2025-11-10 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) pcs-0.10.8-1.el8_4.8, pcs-snmp-0.10.8-1.el8_4.8
    • Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) pcs-0.10.8-1.el8_4.8, pcs-snmp-0.10.8-1.el8_4.8
  • RHSA-2025:19800 Released 2025-11-05 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.9.0) pcs-0.11.1-10.el9_0.9, pcs-snmp-0.11.1-10.el9_0.9
    • Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) pcs-0.11.1-10.el9_0.9, pcs-snmp-0.11.1-10.el9_0.9
  • RHSA-2025:19734 Released 2025-11-04 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.6) pcs-0.10.12-6.el8_6.10, pcs-snmp-0.10.12-6.el8_6.10
    • Red Hat Enterprise Linux High Availability TUS (v.8.6) pcs-0.10.12-6.el8_6.10, pcs-snmp-0.10.12-6.el8_6.10
  • RHSA-2025:19719 Released 2025-11-04 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux HighAvailability (v. 8) pcs-0.10.18-2.el8_10.7, pcs-snmp-0.10.18-2.el8_10.7
    • Red Hat Enterprise Linux ResilientStorage (v. 8) pcs-0.10.18-2.el8_10.7, pcs-snmp-0.10.18-2.el8_10.7
  • RHSA-2025:19647 Released 2025-11-04 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.8) pcs-0.10.15-4.el8_8.9, pcs-snmp-0.10.15-4.el8_8.9
    • Red Hat Enterprise Linux High Availability TUS (v.8.8) pcs-0.10.15-4.el8_8.9, pcs-snmp-0.10.15-4.el8_8.9
  • RHSA-2025:19512 Released 2025-11-03 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 9) pcs-0.11.9-2.el9_6.2, pcs-snmp-0.11.9-2.el9_6.2
    • Red Hat Enterprise Linux Resilient Storage (v. 9) pcs-0.11.9-2.el9_6.2, pcs-snmp-0.11.9-2.el9_6.2
  • RHSA-2025:19513 Released 2025-11-03 · Red Hat rating Important
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 10) cockpit-ha-cluster-0.12.0-3.el10_0.3, pcs-0.12.0-3.el10_0.3, pcs-snmp-0.12.0-3.el10_0.3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Enterprise Linux High Availability (v. 10)Fixed RHSA-2025:19513, RHSA-2025:21036
Red Hat Enterprise Linux High Availability (v. 9)Fixed RHSA-2025:19512, RHSA-2025:20962
Red Hat Enterprise Linux High Availability AUS (v.8.4)Fixed RHSA-2025:19948
Red Hat Enterprise Linux High Availability E4S (v.8.6)Fixed RHSA-2025:19734
Red Hat Enterprise Linux High Availability E4S (v.8.8)Fixed RHSA-2025:19647
Red Hat Enterprise Linux High Availability E4S (v.9.0)Fixed RHSA-2025:19800
Red Hat Enterprise Linux High Availability TUS (v.8.6)Fixed RHSA-2025:19734
Red Hat Enterprise Linux High Availability TUS (v.8.8)Fixed RHSA-2025:19647
Red Hat Enterprise Linux HighAvailability (v. 8)Fixed RHSA-2025:19719
Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4)Fixed RHSA-2025:19948
Red Hat Enterprise Linux Resilient Storage (v. 9)Fixed RHSA-2025:19512, RHSA-2025:20962
Red Hat Enterprise Linux ResilientStorage (v. 8)Fixed RHSA-2025:19719
Red Hat Enterprise Linux ResilientStorage E4S (v.9.0)Fixed RHSA-2025:19800
Red Hat Enterprise Linux Server HighAvailability (v. 7 ELS)Fixed RHSA-2025:21696
Red Hat Enterprise Linux Server ResilientStorage (v. 7 ELS)Fixed RHSA-2025:21696
Not affected: 10 products
  • Logging Subsystem for Red Hat OpenShift
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenStack Platform 13 (Queens)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-61771
  2. 2026-10-03 Alias added: GHSA-w9pc-fmgc-vxvw

References

Patch 3

Advisory 2

Other 2

  • TI-2024-16580 Rack ReDos in content type parsing (2nd degree polynomial) CVSS 3.1HIGH 7.5
  • TI-2024-17236 Possible Denial of Service Vulnerability in Rack Header Parsing CVSS 3.1HIGH 7.5
  • TI-2024-17231 Possible DoS Vulnerability with Range Header in Rack CVSS 3.1HIGH 7.5
  • TI-2023-12254 Uncontrolled resource consumption in https://github.com/rack/rack CVSS 3.1HIGH 7.5
  • TI-2025-38165 Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) CVSS 3.1HIGH 7.5
  • TI-2025-38163 Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) CVSS 3.1HIGH 7.5
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences