GHSA-p543-xpfm-54cp · Severity: high · Ecosystem: rubygems — Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)
Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` buffers the entire multipart preamble (bytes before the first boundary) in memory without any size limit. A client can send a large preamble followed by a valid boundary, causing significant memory use and potential process termination due to out-of-memory (OOM) conditions. Remote attackers can trigger large transient memory spikes by including a long preamble in multipart/form-data requests. The impact scales with allowed request sizes and concurrency, potentially causing worker crashes or severe slowdown due to garbage collection. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a preamble size limit (e.g., 16 KiB) or discard preamble data entirely. Workarounds include limiting total request body size at the proxy or web server level and monitoring memory and set per-process limits to prevent OOM conditions.
Conclusion & alert: CVE-2025-61770 is rated Moderate Risk (49.2/100): CVSS High severity, with medium exploitation likelihood (EPSS 0.85%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.27% | 0.85% | +0.58% |
| 2 | 2026-05-25 | 0.16% | 0.27% | +0.11% |
| 3 | 2026-03-17 | — | 0.16% | — |
Full EPSS history (6 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | [email protected] |
GHSA-p543-xpfm-54cp · Severity: high · Ecosystem: rubygems — Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2025-61770 not yet assigned priority: Debian including 1 source packages (ruby-rack), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2025-61770 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2025-61770 |
suse
|
high | CVE-2025-61770 severity important: SUSE including 10 source package names (pcs-0.10.18-2.el8_10.7, pcs-0.11.9-2.el9_6.2, …), 10 product×package rows across 4 product lines (SUSE Liberty Linux 8, SUSE Liberty Linux 9, openSUSE Leap 15.6, openSUSE Tumbleweed): Fixed 6, Known Not Affected 4. | https://www.suse.com/security/cve/CVE-2025-61770/ |
ubuntu
|
medium | CVE-2025-61770 medium priority: Ubuntu including 1 source packages (ruby-rack), 9 status rows across 9 suites (bionic, focal, jammy, noble, plucky, questing, trusty, upstream, xenial): ignored 5, released 3, needs-triage 1. | https://ubuntu.com/security/CVE-2025-61770 |