CVE-2025-59830
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-25

Last updated on: 2025-10-10

Assigner: GitHub, Inc.

Description
Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-25
Last Modified
2025-10-10
Generated
2026-05-07
AI Q&A
2025-09-25
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
rack rack to 2.2.18 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Rack Ruby web server interface before version 2.2.18. The Rack::QueryParser enforces a limit on the number of parameters only for those separated by '&', but it splits parameters on both '&' and ';'. Attackers can exploit this by using ';' as a separator to bypass the parameter count limit, allowing them to submit more parameters than intended. This can lead to increased CPU and memory usage.


How can this vulnerability impact me? :

If your application or middleware uses Rack::QueryParser with its default configuration, this vulnerability can be exploited to cause increased CPU and memory consumption, potentially leading to a limited denial-of-service (DoS) attack.


What immediate steps should I take to mitigate this vulnerability?

Upgrade Rack to version 2.2.18 or later, where the issue has been patched to properly enforce the params_limit and prevent bypass via ';' separators.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart