CVE-2015-3225

mediumpriority · track · 23EPSS 0.080 · 95 %ileDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

7.99% (95th) EPSS

CVSS 5 · medium

Is it mine?

21 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · scored 2026-10-23

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedpcs-0:0.9.143-15.el7.s390x as a component of Red Hat Enterprise Linux Server High Availability (v. 7)redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:2290
Fixedpcs-0:0.9.143-15.el7.s390x as a component of Red Hat Enterprise Linux Server Resilient Storage (v. 7)redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:2290
Fixedpcs-0:0.9.143-15.el7.src as a component of Red Hat Enterprise Linux Server High Availability (v. 7)redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:2290
Fixedpcs-0:0.9.143-15.el7.src as a component of Red Hat Enterprise Linux Server Resilient Storage (v. 7)redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:2290
Fixedpcs-0:0.9.143-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server High Availability (v. 7)redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:2290
Fixedpcs-0:0.9.143-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server Resilient Storage (v. 7)redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:2290
Fixedpcs-debuginfo-0:0.9.143-15.el7.s390x as a component of Red Hat Enterprise Linux Server High Availability (v. 7)redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:2290
Fixedpcs-debuginfo-0:0.9.143-15.el7.s390x as a component of Red Hat Enterprise Linux Server Resilient Storage (v. 7)redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:2290
Fixedpcs-debuginfo-0:0.9.143-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server High Availability (v. 7)redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:2290
Fixedpcs-debuginfo-0:0.9.143-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server Resilient Storage (v. 7)redhat_csaf
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:2290
Fixedruby4.0-rubygem-rack-2.2-0:2.2.22-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedruby4.0-rubygem-rack-2.2-0:2.2.22-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedruby4.0-rubygem-rack-2.2-0:2.2.22-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedruby4.0-rubygem-rack-2.2-0:2.2.22-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedruby4.0-rubygem-rack-0:3.1.18-1.3.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedruby4.0-rubygem-rack-0:3.1.18-1.3.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedruby4.0-rubygem-rack-0:3.1.18-1.3.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedruby4.0-rubygem-rack-0:3.1.18-1.3.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

cvss

Technical severity, 0–10. One row per scoring source.

5.0

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.05mediumAV:N/AC:L/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USexploitability 10 · impact 2.9

v2.04.3mediumAV:N/AC:L/Au:N/C:N/I:N/A:P/E:Usecondary · CVSS-BT (t0sche)

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:N/A:Psecondary · Red Hat Product Security US

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-19USprimaryCWE-400US

affected products (21)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
debian debian linux= 7.0nvdUScpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*
debian debian linux= 8.0nvdUScpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*
opensuse opensuse= 13.1nvdUScpe:2.3:o:opensuse:opensuse:*:*:*:*:*:*:*:*
opensuse opensuse= 13.2nvdUScpe:2.3:o:opensuse:opensuse:*:*:*:*:*:*:*:*
rack project rack≤ 1.5.3nvdUScpe:2.3:a:rack_project:rack:*:*:*:*:*:*:*:*
rack project rack= 1.6.0nvdUScpe:2.3:a:rack_project:rack:*:*:*:*:*:*:*:*
rack project rack= 1.6.1nvdUScpe:2.3:a:rack_project:rack:*:*:*:*:*:*:*:*
RubyGems rack1.4.0 → 1.4.6osvUSpkg:gem/rack
RubyGems rack1.5.0 → 1.5.4osvUSpkg:gem/rack
RubyGems rack1.6.0 → 1.6.2osvUSpkg:gem/rack
pcs-0:0.9.143-15.el7.s390x as a component of Red Hat Enterprise Linux Server High Availability (v. 7)all versionsfixedredhat_csafUS
pcs-0:0.9.143-15.el7.s390x as a component of Red Hat Enterprise Linux Server Resilient Storage (v. 7)all versionsfixedredhat_csafUS
pcs-0:0.9.143-15.el7.src as a component of Red Hat Enterprise Linux Server High Availability (v. 7)all versionsfixedredhat_csafUS
pcs-0:0.9.143-15.el7.src as a component of Red Hat Enterprise Linux Server Resilient Storage (v. 7)all versionsfixedredhat_csafUS
pcs-0:0.9.143-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server High Availability (v. 7)all versionsfixedredhat_csafUS
pcs-0:0.9.143-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server Resilient Storage (v. 7)all versionsfixedredhat_csafUS
pcs-debuginfo-0:0.9.143-15.el7.s390x as a component of Red Hat Enterprise Linux Server High Availability (v. 7)all versionsfixedredhat_csafUS
pcs-debuginfo-0:0.9.143-15.el7.s390x as a component of Red Hat Enterprise Linux Server Resilient Storage (v. 7)all versionsfixedredhat_csafUS
pcs-debuginfo-0:0.9.143-15.el7.x86_64 as a component of Red Hat Enterprise Linux Server High Availability (v. 7)all versionsfixedredhat_csafUS

showing 20 of 21

advisories (4)

Vendor and ecosystem advisories describing this.

RHSA-2015:2290Red Hat Security Advisory: pcs security, bug fix, and enhancement update2015-11-19csaf · redhat_csafUS
An updated pcs package that fixes one security issue, several bugs, and add various enhancements is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
openSUSE-SU-2026:10286-1ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media2026-03-04csaf · suse_csafDE
ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media
openSUSE-SU-2026:10358-1ruby4.0-rubygem-rack-3.1.18-1.3 on GA media2026-03-13csaf · suse_csafDE
ruby4.0-rubygem-rack-3.1.18-1.3 on GA media
GHSA-rgr4-9jh5-j4j6Rack vulnerable to Denial of Service via large parameter depth request2017-10-24ghsa · osvUS
lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd osv redhat_csaf suse_csaf NVD CVE.org MITRE

published 2015-07-26modified 2026-06-17

related (367)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2017-8570US	high7.8OT critical	89.9% (100th)	KEV	2017-07-11
Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability". This CVE…
CVE-2017-0262US	high7.8OT critical	81.0% (100th)	KEV	2017-05-12
Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Re…
CVE-2015-5477US	high7.8OT critical	99.4% (100th)	KEV	2015-07-29
named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
CVE-2015-1770US	high8.8OT critical	35.0% (98th)	KEV	2015-06-10
Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Uninitialized Memory Use Vulnerabil…
CVE-2015-1671US	high9.3OT critical	48.8% (99th)	KEV	2015-05-13
The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 20…

+362 more

references (26)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan