Log in Start free

Vulnerability · Published Oct 10, 2025 · Assigned by GitHub_M

CVE-2025-61921Sinatra has ReDoS vulnerability in ETag header value generation

Low 2.7

In plain English

A low-severity regular-expression denial of service in sinatra from sinatra. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.7Low
Exploit odds (30 days)0.5%top 57.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ruby-sinatra3.0.5-3+deb12u1DEBIAN-CVE-2025-61921
Debian:13ruby-sinatrano fix listedDEBIAN-CVE-2025-61921
Debian:14ruby-sinatra4.2.1-1DEBIAN-CVE-2025-61921
RubyGemssinatra4.2.0GHSA-mr3q-g2mv-mr4q
Ubuntu:26.04:LTSruby-sinatra4.2.1-1UBUNTU-CVE-2025-61921

Affected products (as reported)

VendorProductVersions
sinatra sinatra < 4.2.0

Weakness: CWE-1333 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References