rack 3.1.10
Rack has an Unbounded-Parameter DoS in Rack::QueryParser
high severity CVE-2025-46727~> 2.2.14, ~> 3.0.16, >= 3.1.14
Summary
Rack::QueryParser parses query strings and
application/x-www-form-urlencoded bodies into Ruby data structures
without imposing any limit on the number of parameters, allowing
attackers to send requests with extremely large numbers of parameters.
Details
The vulnerability arises because Rack::QueryParser iterates over
each &-separated key-value pair and adds it to a Hash without
enforcing an upper bound on the total number of parameters. This
allows an attacker to send a single request containing hundreds of
thousands (or more) of parameters, which consumes excessive memory
and CPU during parsing.
Impact
An attacker can trigger denial of service by sending specifically crafted HTTP requests, which can cause memory exhaustion or pin CPU resources, stalling or crashing the Rack server. This results in full service disruption until the affected worker is restarted.
Mitigation
- Update to a version of Rack that limits the number of parameters parsed, or
- Use middleware to enforce a maximum query string size or parameter count, or
- Employ a reverse proxy (such as Nginx) to limit request sizes and reject oversized query strings or bodies.
Limiting request body sizes and query string lengths at the web server or CDN level is an effective mitigation.
Local File Inclusion in Rack::Static
high severity CVE-2025-27610~> 2.2.13, ~> 3.0.14, >= 3.1.12
Summary
Rack::Static can serve files under the specified root: even if urls: are provided, which may expose other files under the specified root: unexpectedly.
Details
The vulnerability occurs because Rack::Static does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory.
Impact
By exploiting this vulnerability, an attacker can gain access to all files under the specified root: directory, provided they are able to determine then path of the file.
Mitigation
- Update to the latest version of Rack, or
- Remove usage of
Rack::Static, or - Ensure that
root:points at a directory path which only contains files which should be accessed publicly.
It is likely that a CDN or similar static file server would also mitigate the issue.
Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection
medium severity CVE-2025-27111~> 2.2.12, ~> 3.0.13, >= 3.1.11
Summary
Rack::Sendfile can be exploited by crafting input that
includes newline characters to manipulate log entries.
Details
The Rack::Sendfile middleware logs unsanitized header values from
the X-Sendfile-Type header. An attacker can exploit this by
injecting escape sequences (such as newline characters) into the
header, resulting in log injection.
Impact
This vulnerability can distort log files, obscure attack traces, and complicate security auditing.
Mitigation
- Update to the latest version of Rack, or
- Remove usage of
Rack::Sendfile.
No officially reported memory leakage issues detected.
This gem version does not have any officially reported memory leaked issues.
No license issues detected.
This gem version has a license in the gemspec.
This gem version is available.
This gem version has not been yanked and is still available for usage.