Resource exhaustion in Rack - CVE-2025-61919

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU116897

Resource exhaustion in Rack - CVE-2025-61919

Published: October 10, 2025


Vulnerability identifier: #VU116897
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-61919
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in "Rack::Request" form parsing. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


Affected software

Rack
Debian Linux
SUSE Enterprise Server 15 SP3 Business Critical
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Availability Extension 15
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
Anolis OS
openSUSE Leap
Ubuntu
Fedora
IBM Aspera Console
pcs (Red Hat package)
pcs-snmp
pcs
ruby-rack (Ubuntu package)
ruby-rack (Debian package)
ruby2.5-rubygem-rack
ruby2.5-rubygem-rack-doc
rubygem-rack
IBM Cloud Pak for Multicloud Management

How to mitigate CVE-2025-61919

Install updates from vendor's website.

Rack - addressed in versions 2.2.20, 3.1.18, 3.2.3
IBM Aspera Console - update to 3.4.8
pcs (Red Hat package) - addressed in versions 0.9.169-3.el7_9.5, 0.10.12-6.el8_6.10, 0.10.15-4.el8_8.9, 0.10.18-2.el8_10.7, 0.11.1-10.el9_0.9, 0.11.4-7.el9_2.6, 0.11.7-2.el9_4.5, 0.11.10-1.el9_7.1, 0.12.0-3.el10_0.3, 0.12.1-1.el10_1.1
pcs-snmp - update to 0.10.18-2.0.1
pcs - update to 0.10.18-2.0.1
ruby-rack (Ubuntu package) - addressed in versions 1.6.4-3ubuntu0.2+esm9, 1.6.4-4ubuntu0.2+esm9, 2.0.7-2ubuntu0.1+esm8, 2.1.4-5ubuntu1.2, 2.2.7-1ubuntu0.5, 3.1.16-0.1ubuntu0.1
ruby-rack (Debian package) - addressed in versions 2.2.20-0+deb12u1, 3.1.18-1~deb13u1
ruby2.5-rubygem-rack - update to 2.2.20-150000.3.34.1
ruby2.5-rubygem-rack-doc - update to 2.2.20-150000.3.34.1
rubygem-rack - addressed in versions 2.2.21-1.fc41, 2.2.21-9.fc42, 3.1.19-1.fc43
IBM Cloud Pak for Multicloud Management - update to 2.3 Fix Pack 12

External References

Related Security Bulletins