Bug 2402200 (CVE-2025-61772)

Summary: CVE-2025-61772 rack: Rack memory exhaustion denial of service
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akostadi, amasferr, cbartlet, crizzo, dmayorov, eglynn, jcantril, jjoyce, jlledo, jschluet, jvasik, kaycoth, lhh, lsvaty, mburns, mgarciac, mkudlej, mmakovy, pantinor, pgrist, rblanco, rojacob, tjochec, tsedmik, vmugicag
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A denial of service flaw has been found in the rubygems rack package. `Rack::Multipart::Parser` can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (`CRLFCRLF`). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS).
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-10-07 16:02:29 UTC
Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (`CRLFCRLF`). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected. Versions 2.2.19, 3.1.17, and 3.2.2 cap per-part header size (e.g., 64 KiB). As a workaround, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx `client_max_body_size`).

Comment 3 errata-xmlrpc 2025-11-03 20:11:16 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:19513 https://access.redhat.com/errata/RHSA-2025:19513

Comment 4 errata-xmlrpc 2025-11-03 20:18:22 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:19512 https://access.redhat.com/errata/RHSA-2025:19512

Comment 5 errata-xmlrpc 2025-11-04 11:16:25 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2025:19647 https://access.redhat.com/errata/RHSA-2025:19647

Comment 6 errata-xmlrpc 2025-11-04 17:00:49 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:19719 https://access.redhat.com/errata/RHSA-2025:19719

Comment 7 errata-xmlrpc 2025-11-04 19:47:35 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:19733 https://access.redhat.com/errata/RHSA-2025:19733

Comment 8 errata-xmlrpc 2025-11-04 19:58:33 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:19734 https://access.redhat.com/errata/RHSA-2025:19734

Comment 9 errata-xmlrpc 2025-11-04 23:33:33 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:19736 https://access.redhat.com/errata/RHSA-2025:19736

Comment 10 errata-xmlrpc 2025-11-05 13:08:02 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:19800 https://access.redhat.com/errata/RHSA-2025:19800

Comment 11 errata-xmlrpc 2025-11-10 01:34:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2025:19948 https://access.redhat.com/errata/RHSA-2025:19948

Comment 12 errata-xmlrpc 2025-11-11 15:01:13 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:20962 https://access.redhat.com/errata/RHSA-2025:20962

Comment 13 errata-xmlrpc 2025-11-11 19:48:53 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:21036 https://access.redhat.com/errata/RHSA-2025:21036