CVE-2025-46727
highpriority · track · 30EPSS 0.012 · 68 %ileDEEUNLRUUSEPSS · scored 2026-10-27
Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, `Rack::QueryParser` parses query strings and `application/x-www-form-urlencoded` bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with extremely large numbers of parameters. The vulnerability arises because `Rack::QueryParser` iterates over each `&`-separated key-value pair and adds it to a Hash without enforcing an upper bound on the total number of parameters. This allows an attacker to send a single request containing hundreds of thousands (or more) of parameters, which consumes excessive memory and CPU during parsing. An attacker can trigger denial of service by sending specifically crafted HTTP requests, which can cause memory exhaustion or pin CPU resources, stalling or crashing the Rack server. This results in full service disruption until the affected worker is restarted. Versions 2.2.14, 3.0.16, and 3.1.14 fix the issue. Some other mitigations are available. One may use middleware to enforce a maximum query string size or parameter count, or employ a reverse proxy (such as Nginx) to limit request sizes and reject oversized query strings or bodies. Limiting request body sizes and query string lengths at the web server or CDN level is an effective mitigation.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedruby4.0-rubygem-rack-2.2-0:2.2.22-1.1.aarch64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedruby4.0-rubygem-rack-2.2-0:2.2.22-1.1.ppc64le as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedruby4.0-rubygem-rack-2.2-0:2.2.22-1.1.s390x as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedruby4.0-rubygem-rack-2.2-0:2.2.22-1.1.x86_64 as component of openSUSE Tumbleweedsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (115)
Products and version ranges known to be affected.
advisories (5)
Vendor and ecosystem advisories describing this.
- NCSC-2026-0022Kwetsbaarheden verholpen in Oracle Communications productenNL2026-01-21csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in Oracle Communications producten.
- WID-SEC-W-2025-1067Red Hat Satellite: Schwachstelle ermöglicht Denial of ServiceDeutsch2025-05-14csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Satellite ausnutzen, um einen Denial of Service Angriff durchzuführen.
- WID-SEC-W-2026-0153Oracle Communications: Mehrere SchwachstellenDeutsch2026-01-20csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- openSUSE-SU-2026:10286-1ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media2026-03-04csaf · suse_csafDE
ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media
- GHSA-gjh7-p2fx-99vxRack has an Unbounded-Parameter DoS in Rack::QueryParser2025-05-08ghsa · osvUS
## Summary `Rack::QueryParser` parses query strings and `application/x-www-form-urlencoded` bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with extremely large numbers of parameters. ## Details The vulnerability arises because `Rack::QueryParser` iterates over each `&`-separated key-value pair and adds it to a Hash without enforcing an upper bound on the total number of parameters. This allows an attacker to send a single request containing hundreds of thousands (or more) of parameters, which consumes excessive memory and CPU during parsing. ## Impact An attacker can trigger denial of service by sending specifically crafted HTTP requests, which can cause memory exhaustion or pin CPU resources, stalling or crashing the Rack server. This results in full service disruption until the affected worker is restarted. ## Mitigation - Update to a version of Rack that limits the number of parameters parsed, or - Use middleware to enforce a maximum query string size or parameter count, or - Employ a reverse proxy (such as Nginx) to limit request sizes and reject oversized query strings or bodies. Limiting request body sizes and query string lengths at the web server or CDN level is an effective mitigation.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (15)
External citations — patches, advisories, analysis.
- https://github.com/rack/rack/commit/2bb5263b464b65ba4b648996a579dbd180d2b712cnnvd
- https://github.com/rack/rack/commit/3f5a4249118d09d199fe480466c8c6717e43b6e3cnnvd
- https://github.com/rack/rack/commit/cd6b70a1f2a1016b73dc906f924869f4902c2d74cnnvd
- https://github.com/rack/rack/releasesPatchcnnvd
- https://github.com/rack/rack/security/advisories/GHSA-gjh7-p2fx-99vxcnnvd
- https://vigilance.fr/vulnerability/Rack-denial-of-service-via-Rack-QueryParser-47157cnnvd
- https://www.oracle.com/security-alerts/cpujan2026.htmlcnnvd
- https://github.com/rack/rack/commit/2bb5263b464b65ba4b648996a579dbd180d2b712enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan