CVE-2025-61770

{
  "id": "CVE-2025-61770",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-07T15:16:02.950",
  "lastModified": "2026-10-19T16:10:00.260",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` buffers the entire multipart preamble (bytes before the first boundary) in memory without any size limit. A client can send a large preamble followed by a valid boundary, causing significant memory use and potential process termination due to out-of-memory (OOM) conditions. Remote attackers can trigger large transient memory spikes by including a long preamble in multipart/form-data requests. The impact scales with allowed request sizes and concurrency, potentially causing worker crashes or severe slowdown due to garbage collection. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a preamble size limit (e.g., 16 KiB) or discard preamble data entirely. Workarounds include limiting total request body size at the proxy or web server level and monitoring memory and set per-process limits to prevent OOM conditions."
    },
    {
      "lang": "es",
      "value": "Rack es una interfaz modular de servidor web Ruby. En versiones anteriores a 2.2.19, 3.1.17 y 3.2.2, 'Rack::Multipart::Parser' almacena en búfer el preámbulo multipart completo (bytes antes del primer límite) en memoria sin ningún límite de tamaño. Un cliente puede enviar un preámbulo grande seguido de un límite válido, causando un uso significativo de memoria y una posible terminación del proceso debido a condiciones de falta de memoria (OOM). Atacantes remotos pueden desencadenar grandes picos transitorios de memoria al incluir un preámbulo largo en solicitudes multipart/form-data. El impacto escala con los tamaños de solicitud permitidos y la concurrencia, causando potencialmente caídas de workers o una desaceleración severa debido a la recolección de basura. Las versiones 2.2.19, 3.1.17 y 3.2.2 imponen un límite de tamaño de preámbulo (p. ej., 16 KiB) o descartan los datos del preámbulo por completo. Las soluciones incluyen limitar el tamaño total del cuerpo de la solicitud a nivel de proxy o servidor web y monitorear la memoria y establecer límites por proceso para prevenir condiciones OOM."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "rack",
          "product": "rack",
          "versions": [
            {
              "version": "< 2.2.19",
              "status": "affected"
            },
            {
              "version": ">= 3.1, < 3.1.17",
              "status": "affected"
            },
            {
              "version": ">= 3.2, < 3.2.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-07T15:23:07.044511Z",
          "id": "CVE-2025-61770",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
              "versionEndExcluding": "2.2.19",
              "matchCriteriaId": "EBB6060B-A06F-4A88-8457-AD850E63E562"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
              "versionStartIncluding": "3.1.0",
              "versionEndExcluding": "3.1.17",
              "matchCriteriaId": "850EC79C-0F31-441F-9001-B7CA0CD7758F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
              "versionStartIncluding": "3.2.0",
              "versionEndExcluding": "3.2.2",
              "matchCriteriaId": "9A009CC5-8010-446E-A12B-BF5314CA5BEB"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/rack/rack/commit/589127f4ac8b5cf11cf88fb0cd116ffed4d2181e",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/rack/rack/commit/d869fed663b113b95a74ad53e1b5cae6ab31f29e",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/rack/rack/commit/e08f78c656c9394d6737c022bde087e0f33336fd",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/rack/rack/security/advisories/GHSA-p543-xpfm-54cp",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}