CVE-2025-46727: Unbounded-Parameter DoS in Rack::QueryParser
First published: Wed May 07 2025(Updated: )
## Summary `Rack::QueryParser` parses query strings and `application/x-www-form-urlencoded` bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with extremely large numbers of parameters. ## Details The vulnerability arises because `Rack::QueryParser` iterates over each `&`-separated key-value pair and adds it to a Hash without enforcing an upper bound on the total number of parameters. This allows an attacker to send a single request containing hundreds of thousands (or more) of parameters, which consumes excessive memory and CPU during parsing. ## Impact An attacker can trigger denial of service by sending specifically crafted HTTP requests, which can cause memory exhaustion or pin CPU resources, stalling or crashing the Rack server. This results in full service disruption until the affected worker is restarted. ## Mitigation - Update to a version of Rack that limits the number of parameters parsed, or - Use middleware to enforce a maximum query string size or parameter count, or - Employ a reverse proxy (such as Nginx) to limit request sizes and reject oversized query strings or bodies. Limiting request body sizes and query string lengths at the web server or CDN level is an effective mitigation.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rack | <2.2.14<3.0.16<3.1.14 | |
| rubygems/rack | >=3.1<3.1.14 | 3.1.14 |
| rubygems/rack | >=3.0<3.0.16 | 3.0.16 |
| rubygems/rack | <2.2.14 | 2.2.14 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/rack/rack/security/advisories/GHSA-gjh7-p2fx-99vx
- https://github.com/rack/rack/commit/2bb5263b464b65ba4b648996a579dbd180d2b712
- https://github.com/rack/rack/commit/3f5a4249118d09d199fe480466c8c6717e43b6e3
- https://github.com/rack/rack/commit/cd6b70a1f2a1016b73dc906f924869f4902c2d74
- https://nvd.nist.gov/vuln/detail/CVE-2025-46727
- https://github.com/advisories/GHSA-gjh7-p2fx-99vx (Advisory)
Frequently Asked Questions
What is the severity of CVE-2025-46727?
CVE-2025-46727 has been classified as a medium severity vulnerability due to the potential for Denial of Service attacks.
What versions of Rack are affected by CVE-2025-46727?
CVE-2025-46727 affects Rack versions prior to 2.2.14, 3.0.16, and 3.1.14.
How do I fix CVE-2025-46727?
To fix CVE-2025-46727, upgrade Rack to versions 2.2.14, 3.0.16, or 3.1.14 or later.
What type of attack does CVE-2025-46727 allow?
CVE-2025-46727 allows attackers to execute Denial of Service attacks by sending an excessive number of parameters in query strings.
How does CVE-2025-46727 impact my application?
CVE-2025-46727 can lead to excessive resource consumption in your application, potentially causing it to crash or become unresponsive.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/author
- agent/severity
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/nvd-api
- source/NVD
- collector/nvd-cve
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-gjh7-p2fx-99vx
- alias/CVE-2025-46727
- agent/last-modified-date
- agent/references
- agent/source
- agent/tags
- agent/description
- agent/softwarecombine
- agent/event
- vendor/rack
- canonical/rack
- package-manager/rubygems