Ruby/rack/3.1.12

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Repo Link: https://rubygems.org/gems/rack
License: MIT

2 Security Vulnerabilities

Rack has an Unbounded-Parameter DoS in Rack::QueryParser

Published date: 2025-05-08T14:45:48Z

CVE: CVE-2025-46727

Links:

Summary

Rack::QueryParser parses query strings and application/x-www-form-urlencoded bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with extremely large numbers of parameters.

Details

The vulnerability arises because Rack::QueryParser iterates over each &-separated key-value pair and adds it to a Hash without enforcing an upper bound on the total number of parameters. This allows an attacker to send a single request containing hundreds of thousands (or more) of parameters, which consumes excessive memory and CPU during parsing.

Impact

An attacker can trigger denial of service by sending specifically crafted HTTP requests, which can cause memory exhaustion or pin CPU resources, stalling or crashing the Rack server. This results in full service disruption until the affected worker is restarted.

Mitigation

Update to a version of Rack that limits the number of parameters parsed, or
Use middleware to enforce a maximum query string size or parameter count, or
Employ a reverse proxy (such as Nginx) to limit request sizes and reject oversized query strings or bodies.

Limiting request body sizes and query string lengths at the web server or CDN level is an effective mitigation.

Affected versions: ["3.1.2", "3.1.1", "3.1.0", "3.1.3", "3.1.4", "3.1.6", "3.1.5", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13", "3.0.0", "3.0.1", "3.0.2", "3.0.3", "3.0.4", "3.0.4.1", "3.0.4.2", "3.0.5", "3.0.6", "3.0.6.1", "3.0.7", "3.0.8", "3.0.9", "3.0.9.1", "3.0.10", "3.0.11", "3.0.12", "3.0.13", "3.0.14", "3.0.15", "2.2.3", "2.2.2", "2.2.1", "2.2.0", "2.1.1", "2.0.9", "2.0.7", "2.0.6", "2.0.4", "2.0.3", "2.0.2", "1.6.11", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.1", "1.6.0", "1.6.0.beta", "1.5.5", "1.5.3", "1.5.1", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.6", "1.4.3", "1.4.2", "1.3.7", "1.3.5", "1.3.4", "1.3.2", "1.3.0", "1.3.0.beta", "1.2.7", "1.2.6", "1.2.3", "1.2.1", "1.1.4", "1.1.3", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.0", "0.9.1", "0.4.0", "0.2.0", "0.1.0", "2.1.4", "2.1.3", "2.1.2", "2.1.0", "2.0.8", "2.0.5", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.10", "1.6.9", "1.6.8", "1.6.3", "1.6.2", "1.6.0.beta2", "1.5.4", "1.5.2", "1.5.0", "1.4.7", "1.4.5", "1.4.4", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.6", "1.3.3", "1.3.1", "1.3.0.beta2", "1.2.8", "1.2.5", "1.2.4", "1.2.2", "1.2.0", "1.1.6", "1.1.5", "1.1.2", "1.0.1", "0.9.0", "0.3.0", "2.2.3.1", "2.1.4.1", "2.0.9.1", "2.2.4", "2.2.5", "2.2.6", "2.2.6.2", "2.2.6.1", "2.1.4.2", "2.0.9.2", "2.2.6.3", "2.1.4.3", "2.0.9.3", "2.2.6.4", "2.2.7", "2.2.8", "2.2.8.1", "2.1.4.4", "2.0.9.4", "2.2.9", "2.2.10", "2.2.11", "2.2.12", "2.2.13"]

Secure versions: [2.2.14, 2.2.15, 2.2.16, 2.2.17, 3.0.16, 3.0.17, 3.0.18, 3.1.14, 3.1.15, 3.1.16]

Recommendation: Update to version 3.1.16.

Rack has an Unbounded-Parameter DoS in Rack::QueryParser

Published date: 2025-05-08

CVE: 2025-46727

CVSS V3: 7.5

Links:

https://github.com/rack/rack/security/advisories/GHSA-gjh7-p2fx-99vx

Summary

Details

Impact

Mitigation

Update to a version of Rack that limits the number of parameters parsed, or
Use middleware to enforce a maximum query string size or parameter count, or
Employ a reverse proxy (such as Nginx) to limit request sizes and reject oversized query strings or bodies.

Limiting request body sizes and query string lengths at the web server or CDN level is an effective mitigation.

Affected versions: ["2.1.1", "2.0.9", "2.0.7", "2.0.6", "2.0.4", "2.0.3", "2.0.2", "1.6.11", "1.6.7", "1.6.6", "1.6.5", "1.6.4", "1.6.1", "1.6.0", "1.6.0.beta", "1.5.5", "1.5.3", "1.5.1", "1.5.0.beta.2", "1.5.0.beta.1", "1.4.6", "1.4.3", "1.4.2", "1.3.7", "1.3.5", "1.3.4", "1.3.2", "1.3.0", "1.3.0.beta", "1.2.7", "1.2.6", "1.2.3", "1.2.1", "1.1.4", "1.1.3", "1.1.1", "1.1.1.pre", "1.1.0", "1.0.0", "0.9.1", "0.4.0", "0.2.0", "0.1.0", "2.1.4", "2.1.3", "2.1.2", "2.1.0", "2.0.8", "2.0.5", "2.0.1", "2.0.0.rc1", "2.0.0.alpha", "1.6.13", "1.6.12", "1.6.10", "1.6.9", "1.6.8", "1.6.3", "1.6.2", "1.6.0.beta2", "1.5.4", "1.5.2", "1.5.0", "1.4.7", "1.4.5", "1.4.4", "1.4.1", "1.4.0", "1.3.10", "1.3.9", "1.3.8", "1.3.6", "1.3.3", "1.3.1", "1.3.0.beta2", "1.2.8", "1.2.5", "1.2.4", "1.2.2", "1.2.0", "1.1.6", "1.1.5", "1.1.2", "1.0.1", "0.9.0", "0.3.0", "2.1.4.1", "2.0.9.1", "2.1.4.2", "2.0.9.2", "2.1.4.3", "2.0.9.3", "2.1.4.4", "2.0.9.4", "3.1.2", "3.1.1", "3.1.0", "3.1.3", "3.1.4", "3.1.6", "3.1.5", "3.1.7", "3.1.8", "3.1.9", "3.1.10", "3.1.11", "3.1.12", "3.1.13"]

Secure versions: [2.2.14, 2.2.15, 2.2.16, 2.2.17, 3.0.16, 3.0.17, 3.0.18, 3.1.14, 3.1.15, 3.1.16]

Recommendation: Update to version 3.1.16.

160 Other Versions

Version	License	Security	Released
1.6.3	MIT	33	2015-06-18 - 18:45	about 10 years
1.6.2	MIT	33	2015-06-16 - 17:59	about 10 years
1.6.1	MIT	36	2015-05-06 - 18:37	about 10 years
1.6.0	MIT	36	2014-12-18 - 22:45	over 10 years
1.6.0.beta2	MIT	34	2014-11-27 - 18:52	over 10 years
1.6.0.beta	MIT	34	2014-08-18 - 19:02	almost 11 years
1.5.5	MIT	35	2015-06-18 - 18:46	about 10 years
1.5.4	MIT	35	2015-06-16 - 17:58	about 10 years
1.5.3	MIT	37	2015-05-06 - 18:43	about 10 years
1.5.2	MIT	37	2013-02-08 - 03:14	over 12 years
1.5.1	UNKNOWN	41	2013-01-28 - 22:52	over 12 years
1.5.0	UNKNOWN	41	2013-01-22 - 07:40	over 12 years
1.5.0.beta.1	UNKNOWN	36	2013-01-11 - 22:58	over 12 years
1.5.0.beta.2	UNKNOWN	36	2013-01-13 - 22:10	over 12 years
1.4.7	UNKNOWN	34	2015-06-18 - 21:12	about 10 years
1.4.6	UNKNOWN	34	2015-06-16 - 20:47	about 10 years
1.4.5	UNKNOWN	36	2013-02-08 - 03:13	over 12 years
1.4.4	UNKNOWN	38	2013-01-13 - 22:07	over 12 years
1.4.3	UNKNOWN	40	2013-01-07 - 18:49	over 12 years
1.4.2	UNKNOWN	42	2013-01-07 - 02:43	over 12 years
1.4.1	UNKNOWN	44	2012-01-23 - 06:51	over 13 years
1.4.0	UNKNOWN	44	2011-12-28 - 02:56	over 13 years
1.3.10	UNKNOWN	37	2013-02-08 - 03:11	over 12 years
1.3.9	UNKNOWN	38	2013-01-13 - 22:07	over 12 years
1.3.8	UNKNOWN	39	2013-01-07 - 18:49	over 12 years
1.3.7	UNKNOWN	40	2013-01-07 - 02:42	over 12 years
1.3.6	UNKNOWN	41	2011-12-28 - 02:52	over 13 years
1.3.5	UNKNOWN	42	2011-10-18 - 05:33	over 13 years
1.3.4	UNKNOWN	42	2011-10-01 - 20:50	over 13 years
1.3.3	UNKNOWN	42	2011-09-16 - 23:32	almost 14 years
1.3.2	UNKNOWN	42	2011-07-26 - 01:40	almost 14 years
1.3.1	UNKNOWN	42	2011-07-13 - 23:20	almost 14 years
1.3.0	UNKNOWN	42	2011-05-23 - 06:08	about 14 years
1.3.0.beta2	UNKNOWN	35	2011-05-19 - 17:16	about 14 years
1.3.0.beta	UNKNOWN	35	2011-05-03 - 10:39	about 14 years
1.2.8	UNKNOWN	36	2013-02-08 - 03:09	over 12 years
1.2.7	UNKNOWN	37	2013-01-13 - 22:05	over 12 years
1.2.6	UNKNOWN	38	2013-01-07 - 02:39	over 12 years
1.2.5	UNKNOWN	39	2011-12-28 - 02:48	over 13 years
1.2.4	UNKNOWN	40	2011-09-17 - 00:00	almost 14 years
1.2.3	UNKNOWN	40	2011-05-23 - 07:42	about 14 years
1.2.2	UNKNOWN	40	2011-03-13 - 14:03	over 14 years
1.2.1	UNKNOWN	40	2010-06-15 - 09:57	about 15 years
1.2.0	UNKNOWN	40	2010-06-13 - 17:53	about 15 years
1.1.6	UNKNOWN	34	2013-02-08 - 03:08	over 12 years
1.1.5	UNKNOWN	35	2013-01-13 - 22:03	over 12 years
1.1.4	UNKNOWN	36	2013-01-07 - 02:21	over 12 years
1.1.3	UNKNOWN	37	2011-12-28 - 02:37	over 13 years
1.1.2	UNKNOWN	38	2011-03-13 - 14:02	over 14 years
1.1.1	UNKNOWN	38	2011-03-01 - 06:04	over 14 years