CVE-2025-59830: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters
Summary
Rack::QueryParser in version < 2.2.18 enforces its paramslimit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended.
Details
The issue arises because Rack::QueryParser#checkquerystring counts only & characters when determining the number of parameters, but the default separator regex DEFAULTSEP = /[&;] /n splits on both & and ;. This mismatch means that queries using ; separators were not included in the parameter count, allowing paramslimit to be bypassed.
Other safeguards (bytesizelimit and keyspacelimit) still applied, but did not prevent this particular bypass.
Impact
Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector.
Rack::Request, the primary entry point for typical Rack applications, uses QueryParser in a safe way and does not appear vulnerable by default. As such, the severity is considered low, with the impact limited to edge cases where QueryParser is used directly.
Mitigation
Upgrade to a patched version of Rack where both & and ; are counted consistently toward paramslimit. If upgrading is not immediately possible, configure QueryParser with an explicit delimiter (e.g., &) to avoid the mismatch. As a general precaution, enforce query string and request size limits at the web server or proxy layer (e.g., Nginx, Apache, or a CDN) to mitigate excessive parsing overhead.
Other sources
Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its paramslimit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/rackto a version that resolves this vulnerability.Fixed in 2.2.18 - Upgrade
Upgrade
Rack::QueryParserto a version that resolves this vulnerability.Fixed in 2.2.18 - Configuration
If upgrading is not immediately possible, configure Rack::QueryParser with an explicit delimiter of '&' so that params_limit counting and query splitting are consistent.
Rack::QueryParser delimiter (explicit delimiter to avoid mismatch with DEFAULT_SEP) = & - Configuration
Ensure Rack::QueryParser does not use the default configuration where params_limit counting considers only '&' while the default separator regex splits on both '&' and ';' (e.g., set an explicit delimiter such as '&' or upgrade to 2.2.18).
Rack::QueryParser DEFAULT_SEP / delimiter regex (separator handling) = /[&;] */n (avoid relying on unsafe default) - Compensating control
As a general precaution, enforce query string and request size limits at the web server or proxy layer (e.g., Nginx, Apache, or a CDN) to mitigate excessive parsing overhead.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59830?
CVE-2025-59830 has a medium severity rating due to its potential for parameter limit bypass, allowing attackers to exploit the vulnerability.
How do I fix CVE-2025-59830?
To fix CVE-2025-59830, upgrade Rack to version 2.2.18 or later to ensure proper enforcement of parameter limits.
What types of software are affected by CVE-2025-59830?
CVE-2025-59830 affects Rack versions prior to 2.2.18, specifically targeting the Rack::QueryParser component.
Can CVE-2025-59830 lead to data exposure?
Yes, if exploited, CVE-2025-59830 can allow attackers to bypass parameter limits and potentially expose sensitive data.
What is the cause of CVE-2025-59830?
CVE-2025-59830 is caused by Rack::QueryParser's failure to enforce parameters_limit for parameters separated by semicolons, allowing an attacker to manipulate request input.