CVE-2025-59830

Katalog CVE

CVSS 7.5 · High EPSS 0,57%

Kerentanan Uncontrolled Resource Consumption pada rack. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18.

Rincian

Terbit di NVD

25 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,57% peluang dieksploitasi; lebih tinggi dari 45,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rack/rack/security/advisories/GHSA-625h-95r8-8xpm mitigasi · advisory vendor
• https://github.com/rack/rack/commit/54e4ffdd5affebcb0c015cc6ae74635c0831ed71 patch