Bug 2402200 (CVE-2025-61772) - CVE-2025-61772 rack: Rack memory exhaustion denial of service
Summary: CVE-2025-61772 rack: Rack memory exhaustion denial of service
Keywords:
Status: NEW
Alias: CVE-2025-61772
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-10-07 16:02 UTC by OSIDB Bzimport
Modified: 2025-11-11 19:48 UTC (History)
25 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2025:19512 0 None None None 2025-11-03 20:18:25 UTC
Red Hat Product Errata RHSA-2025:19513 0 None None None 2025-11-03 20:11:18 UTC
Red Hat Product Errata RHSA-2025:19647 0 None None None 2025-11-04 11:16:28 UTC
Red Hat Product Errata RHSA-2025:19719 0 None None None 2025-11-04 17:00:51 UTC
Red Hat Product Errata RHSA-2025:19733 0 None None None 2025-11-04 19:47:40 UTC
Red Hat Product Errata RHSA-2025:19734 0 None None None 2025-11-04 19:58:36 UTC
Red Hat Product Errata RHSA-2025:19736 0 None None None 2025-11-04 23:33:36 UTC
Red Hat Product Errata RHSA-2025:19800 0 None None None 2025-11-05 13:08:05 UTC
Red Hat Product Errata RHSA-2025:19948 0 None None None 2025-11-10 01:34:52 UTC
Red Hat Product Errata RHSA-2025:20962 0 None None None 2025-11-11 15:01:16 UTC
Red Hat Product Errata RHSA-2025:21036 0 None None None 2025-11-11 19:48:56 UTC

Description OSIDB Bzimport 2025-10-07 16:02:29 UTC 
Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (`CRLFCRLF`). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected. Versions 2.2.19, 3.1.17, and 3.2.2 cap per-part header size (e.g., 64 KiB). As a workaround, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx `client_max_body_size`).
Comment 3 errata-xmlrpc 2025-11-03 20:11:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:19513 https://access.redhat.com/errata/RHSA-2025:19513
Comment 4 errata-xmlrpc 2025-11-03 20:18:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:19512 https://access.redhat.com/errata/RHSA-2025:19512
Comment 5 errata-xmlrpc 2025-11-04 11:16:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2025:19647 https://access.redhat.com/errata/RHSA-2025:19647
Comment 6 errata-xmlrpc 2025-11-04 17:00:49 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:19719 https://access.redhat.com/errata/RHSA-2025:19719
Comment 7 errata-xmlrpc 2025-11-04 19:47:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:19733 https://access.redhat.com/errata/RHSA-2025:19733
Comment 8 errata-xmlrpc 2025-11-04 19:58:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:19734 https://access.redhat.com/errata/RHSA-2025:19734
Comment 9 errata-xmlrpc 2025-11-04 23:33:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:19736 https://access.redhat.com/errata/RHSA-2025:19736
Comment 10 errata-xmlrpc 2025-11-05 13:08:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:19800 https://access.redhat.com/errata/RHSA-2025:19800
Comment 11 errata-xmlrpc 2025-11-10 01:34:50 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2025:19948 https://access.redhat.com/errata/RHSA-2025:19948
Comment 12 errata-xmlrpc 2025-11-11 15:01:13 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:20962 https://access.redhat.com/errata/RHSA-2025:20962
Comment 13 errata-xmlrpc 2025-11-11 19:48:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2025:21036 https://access.redhat.com/errata/RHSA-2025:21036
Note You need to log in before you can comment on or make changes to this bug.