CVE-2025-61772
📋 TL;DR
This vulnerability in Rack's multipart parser allows remote attackers to cause denial of service by sending incomplete multipart headers that trigger unbounded memory accumulation. All Ruby web applications using vulnerable Rack versions that handle multipart uploads are affected. The parser fails to cap header size, enabling memory exhaustion and process termination.
💻 Affected Systems
- Rack (Ruby web server interface)
📦 What is this software?
Rack by Rack
Rack by Rack
Rack by Rack
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage due to memory exhaustion, causing application crashes and unavailability for all users.
Likely Case
Degraded performance, intermittent crashes, and increased resource consumption affecting application responsiveness.
If Mitigated
Minimal impact with proper request size limits and updated Rack versions preventing memory exhaustion.
🎯 Exploit Status
Exploitation requires sending HTTP requests with malformed multipart headers, which is straightforward to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.19, 3.1.17, or 3.2.2
Vendor Advisory: https://github.com/rack/rack/security/advisories/GHSA-wpv5-97wm-hp9c
Restart Required: Yes
Instructions:
1. Update Rack gem to patched version: `bundle update rack` or `gem update rack`. 2. Verify version with `rack --version`. 3. Restart application server.
🔧 Temporary Workarounds
Restrict request size at proxy/load balancer
allLimit maximum request body size to prevent large malicious requests from reaching the application.
nginx: `client_max_body_size 10M;` in server block
Apache: `LimitRequestBody 10485760` in config
🧯 If You Can't Patch
- Implement request size limits at application level using middleware
- Deploy WAF rules to block requests with malformed multipart headers
🔍 How to Verify
Check if Vulnerable:
Check Rack version: `rack --version` or `bundle show rack`. If version is below 2.2.19, 3.1.17, or 3.2.2, system is vulnerable.Check Version:
rack --versionVerify Fix Applied:
Confirm Rack version is 2.2.19+, 3.1.17+, or 3.2.2+ and test multipart upload functionality.📡 Detection & Monitoring
Log Indicators:
- High memory usage spikes
- Process OOM kills
- Unusually large request sizes in access logs
Network Indicators:
- HTTP requests with incomplete multipart headers
- Requests hanging during multipart processing
SIEM Query:
source="application.log" AND ("out of memory" OR "OOM" OR "memory exhausted") AND process="rack"