GHSA-gjh7-p2fx-99vx
First published: Thu May 08 2025(Updated: )
## Summary `Rack::QueryParser` parses query strings and `application/x-www-form-urlencoded` bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with extremely large numbers of parameters. ## Details The vulnerability arises because `Rack::QueryParser` iterates over each `&`-separated key-value pair and adds it to a Hash without enforcing an upper bound on the total number of parameters. This allows an attacker to send a single request containing hundreds of thousands (or more) of parameters, which consumes excessive memory and CPU during parsing. ## Impact An attacker can trigger denial of service by sending specifically crafted HTTP requests, which can cause memory exhaustion or pin CPU resources, stalling or crashing the Rack server. This results in full service disruption until the affected worker is restarted. ## Mitigation - Update to a version of Rack that limits the number of parameters parsed, or - Use middleware to enforce a maximum query string size or parameter count, or - Employ a reverse proxy (such as Nginx) to limit request sizes and reject oversized query strings or bodies. Limiting request body sizes and query string lengths at the web server or CDN level is an effective mitigation.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| rubygems/rack | >=3.1<3.1.14 | 3.1.14 |
| rubygems/rack | >=3.0<3.0.16 | 3.0.16 |
| rubygems/rack | <2.2.14 | 2.2.14 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/rack/rack/security/advisories/GHSA-gjh7-p2fx-99vx
- https://nvd.nist.gov/vuln/detail/CVE-2025-46727
- https://github.com/rack/rack/commit/2bb5263b464b65ba4b648996a579dbd180d2b712
- https://github.com/rack/rack/commit/3f5a4249118d09d199fe480466c8c6717e43b6e3
- https://github.com/rack/rack/commit/cd6b70a1f2a1016b73dc906f924869f4902c2d74
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-46727.yml
- https://github.com/advisories/GHSA-gjh7-p2fx-99vx (Advisory)
Frequently Asked Questions
What is the severity of GHSA-gjh7-p2fx-99vx?
The severity of GHSA-gjh7-p2fx-99vx is considered high due to the potential for attackers to exploit the lack of limits on parameters.
How do I fix GHSA-gjh7-p2fx-99vx?
To fix GHSA-gjh7-p2fx-99vx, upgrade Rack to version 3.1.14, 3.0.16, or 2.2.14 as applicable.
What is the impact of GHSA-gjh7-p2fx-99vx?
The impact of GHSA-gjh7-p2fx-99vx allows attackers to send excessively large numbers of parameters, which may lead to denial of service.
What software is affected by GHSA-gjh7-p2fx-99vx?
GHSA-gjh7-p2fx-99vx affects Rack versions before 3.1.14, 3.0.16, and 2.2.14.
Is there a known exploit for GHSA-gjh7-p2fx-99vx?
There is no publicly available exploit for GHSA-gjh7-p2fx-99vx, but the vulnerability itself poses significant risks if left unaddressed.
- agent/last-modified-date
- agent/severity
- agent/references
- agent/weakness
- agent/source
- agent/type
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- agent/tags
- agent/event
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-gjh7-p2fx-99vx
- alias/CVE-2025-46727
- agent/software-canonical-lookup
- package-manager/rubygems