CVE-2025-61770
BaseFortify
Publication date: 2025-10-07
Last updated on: 2025-10-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rack | rack | to 2.2.19 (exc) |
| rack | rack | From 3.1.0 (inc) to 3.1.17 (exc) |
| rack | rack | From 3.2.0 (inc) to 3.2.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Rack Ruby web server interface where the Rack::Multipart::Parser component buffers the entire multipart preamble (the bytes before the first boundary) in memory without any size limit. An attacker can exploit this by sending a very large preamble followed by a valid boundary in a multipart/form-data request, causing excessive memory usage. This can lead to out-of-memory conditions, potentially crashing the server process or causing severe slowdowns.
How can this vulnerability impact me? :
The vulnerability can cause significant memory spikes on the server handling multipart/form-data requests, which may lead to worker process crashes or severe performance degradation due to garbage collection overhead. This can disrupt service availability and reliability, especially under high concurrency or with large allowed request sizes.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unusually high memory usage or out-of-memory (OOM) conditions in processes handling multipart/form-data requests. Since the issue involves large multipart preambles causing memory spikes, you can use system monitoring tools to observe memory consumption patterns. Commands such as 'top', 'htop', or 'ps aux --sort=-rss' can help identify processes with high memory usage. Additionally, inspecting web server logs for unusually large multipart/form-data requests may help detect exploitation attempts. However, no specific detection commands are provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Rack to versions 2.2.19, 3.1.17, or 3.2.2 or later, which enforce a preamble size limit or discard preamble data entirely. If upgrading is not immediately possible, workarounds include limiting the total request body size at the proxy or web server level and monitoring memory usage with per-process limits to prevent out-of-memory conditions.