Vulnerability · Published Sep 25, 2025 · Assigned by GitHub_M
CVE-2025-59830Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters
High 7.5
In plain English
A high-severity uncontrolled resource consumption in rack from rack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | cockpit-ha-cluster | 0.12.1-1.el10_1.1 | ALSA-2025:21036 |
| AlmaLinux:8 | pcs | 0.10.18-2.el8_10.7.alma.1 | ALSA-2025:19719 |
| AlmaLinux:9 | pcs | 0.11.10-1.el9_7.1 | ALSA-2025:20962 |
| AlmaLinux:8 | pcs-snmp | 0.10.18-2.el8_10.7.alma.1 | ALSA-2025:19719 |
| AlmaLinux:9 | pcs-snmp | 0.11.10-1.el9_7.1 | ALSA-2025:20962 |
| Debian:12 | ruby-rack | 2.2.20-0+deb12u1 | DEBIAN-CVE-2025-59830 |
| Debian:13 | ruby-rack | 3.0.8-2 | DEBIAN-CVE-2025-59830 |
| Debian:14 | ruby-rack | 3.0.8-2 | DEBIAN-CVE-2025-59830 |
| Rocky Linux:8 | pcs | 0:0.10.18-2.el8_10.7 | RLSA-2025:19719 |
| Rocky Linux:9 | pcs | 0:0.11.10-1.el9_7.1 | RLSA-2025:20962 |
| Rocky Linux:9 | pcs | 0:0.11.9-2.el9_6.2 | RLSA-2025:19512 |
| RubyGems | rack | 2.2.18 | GHSA-625h-95r8-8xpm |
| Ubuntu:22.04:LTS | ruby-rack | 2.1.4-5ubuntu1.2 | UBUNTU-CVE-2025-59830 |
| Ubuntu:24.04:LTS | ruby-rack | 2.2.7-1ubuntu0.4 | USN-7784-1 |
| Ubuntu:24.04:LTS | ruby-rack | 2.2.7-1ubuntu0.4 | UBUNTU-CVE-2025-59830 |
Affected products (as reported)
Weakness: CWE-400, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/rack/rack/security/advisories/GHSA-625h-95r8-8xpm x_refsource_CONFIRM
- https://github.com/rack/rack/commit/54e4ffdd5affebcb0c015cc6ae74635c0831ed71 x_refsource_MISC