CVE-2025-61921: Sinatra has ReDoS vulnerability in ETag header value generation
Summary
There is a denial of service vulnerability in the If-Match and If-None-Match header parsing component of Sinatra, if the etag method is used when constructing the response and you are using Ruby < 3.2.
Details
Carefully crafted input can cause If-Match and If-None-Match header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the ETag header value. Any applications that use the etag method when generating a response are impacted if they are using Ruby below version 3.2.
Resources
https://github.com/sinatra/sinatra/issues/2120 (report) https://github.com/sinatra/sinatra/pull/2121 (fix) https://github.com/sinatra/sinatra/pull/1823 (older ReDoS vulnerability) https://bugs.ruby-lang.org/issues/19104 (fix in Ruby >= 3.2)
Other sources
Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the If-Match and If-None-Match header parsing component of Sinatra, if the etag method is used when constructing the response. Carefully crafted input can cause If-Match and If-None-Match header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the ETag header value. Any applications that use the etag method when generating a response are impacted. Version 4.2.0 fixes the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/sinatrato a version that resolves this vulnerability.Fixed in 4.2.0 - Upgrade
Upgrade
debian/ruby-sinatrato a version that resolves this vulnerability.Fixed in 3.0.5-3+deb12u1Fixed in 4.2.1-5 - Upgrade
Upgrade
sinatrato a version that resolves this vulnerability.Fixed in 4.2.0 - Upgrade
Upgrade
rubyto a version that resolves this vulnerability.Fixed in 3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61921?
CVE-2025-61921 is classified as a denial of service vulnerability.
How do I fix CVE-2025-61921?
To fix CVE-2025-61921, update Sinatra to version 4.2.0 or later.
What components are affected by CVE-2025-61921?
CVE-2025-61921 affects the `If-Match` and `If-None-Match` header parsing in Sinatra versions before 4.2.0.
What versions of Sinatra are impacted by CVE-2025-61921?
Sinatra versions prior to 4.2.0 are impacted by CVE-2025-61921.
What should I do if I cannot upgrade Sinatra to fix CVE-2025-61921?
If you cannot upgrade Sinatra, consider implementing additional security measures to mitigate denial of service attacks.