vulnerability

Red Hat: CVE-2025-61919: rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion (Multiple Advisories)

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:N/I:N/A:C)
Published
Oct 10, 2025
Added
Nov 5, 2025
Modified
Jan 28, 2026

Description

A memory-exhaustion vulnerability exists in Rack when parsing application/x-www-form-urlencoded request bodies. Rack::Request#POST reads the entire request body into memory without enforcing a maximum length or cap. Attackers can exploit this by sending large form submissions, potentially causing denial of service (DoS) through memory exhaustion. Even with configured parsing limits, the issue occurs before those limits are enforced, allowing unbounded memory allocation proportional to request size.

Solutions

redhat-upgrade-pcsredhat-upgrade-pcs-snmp
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.