Rack up to 2.2.17 Configuration Rack::QueryParser resource consumption

Summaryinfo

A vulnerability was found in Rack up to 2.2.17. It has been rated as problematic. This issue affects the function Rack::QueryParser of the component Configuration Handler. Performing a manipulation results in resource consumption. This vulnerability is reported as CVE-2025-59830. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Rack up to 2.2.17. This affects the function Rack::QueryParser of the component Configuration Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. The summary by CVE is:

Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-59830 since 09/22/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 266123 (Linux Distros Unpatched Vulnerability : CVE-2025-59830), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.2.18 eliminates this vulnerability. Applying the patch 54e4ffdd5affebcb0c015cc6ae74635c0831ed71 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (266123) and CERT Bund (WID-SEC-2025-2482). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Debian Linux
• Red Hat Enterprise Linux
• Oracle Linux
• RESF Rocky Linux

Productinfo

Name

• Rack

Version

• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7
• 2.2.8
• 2.2.9
• 2.2.10
• 2.2.11
• 2.2.12
• 2.2.13
• 2.2.14
• 2.2.15
• 2.2.16
• 2.2.17

License

• open-source

Website

• Product: https://github.com/rack/rack/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion