GHSA-wpv5-97wm-hp9c · Severity: high · Ecosystem: rubygems — Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (`CRLFCRLF`). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected. Versions 2.2.19, 3.1.17, and 3.2.2 cap per-part header size (e.g., 64 KiB). As a workaround, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx `client_max_body_size`).
Conclusion & alert: CVE-2025-61772 is rated Moderate Risk (49.5/100): CVSS High severity, with medium exploitation likelihood (EPSS 0.32%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-05-25 | 0.19% | 0.32% | +0.13% |
| 2 | 2026-03-17 | 0.14% | 0.19% | +0.06% |
| 3 | 2026-03-05 | — | 0.14% | — |
Full EPSS history (6 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | [email protected] |
GHSA-wpv5-97wm-hp9c · Severity: high · Ecosystem: rubygems — Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2025-61772 not yet assigned priority: Debian including 1 source packages (ruby-rack), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2025-61772 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2025-61772 |
suse
|
high | CVE-2025-61772 severity important: SUSE including 10 source package names (pcs-0.10.18-2.el8_10.7, pcs-0.11.9-2.el9_6.2, …), 10 product×package rows across 4 product lines (SUSE Liberty Linux 8, SUSE Liberty Linux 9, openSUSE Leap 15.6, openSUSE Tumbleweed): Fixed 6, Known Not Affected 4. | https://www.suse.com/security/cve/CVE-2025-61772/ |
ubuntu
|
medium | CVE-2025-61772 medium priority: Ubuntu including 1 source packages (ruby-rack), 9 status rows across 9 suites (bionic, focal, jammy, noble, plucky, questing, trusty, upstream, xenial): ignored 5, released 3, needs-triage 1. | https://ubuntu.com/security/CVE-2025-61772 |