CVE-2025-59830
Fixed in a distro release EPSS <1%CVSS 7.5
Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18.
Products: Rack
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | rack | 2.2.18 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | cockpit-ha-cluster | 0.12.1-1.el10_1.1 |
| AlmaLinux 8 | pcs | 0.10.18-2.el8_10.7.alma.1 |
| AlmaLinux 8 | pcs-snmp | 0.10.18-2.el8_10.7.alma.1 |
| AlmaLinux 9 | pcs | 0.11.10-1.el9_7.1 |
| AlmaLinux 9 | pcs-snmp | 0.11.10-1.el9_7.1 |
| Chainguard | gitlab-rails-ce-18.1 | 18.1.6-r13 |
| Chainguard | gitlab-rails-ce-18.2 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.2 | no fix |
| Chainguard | ruby3.2-rack-2.2 | 2.2.22-r0 |
| Chainguard | ruby3.3-rack-2.2 | 2.2.22-r0 |
| Chainguard | ruby3.4-rack-2.2 | 2.2.22-r0 |
| Chainguard | ruby4.0-rack-2.2 | 2.2.22-r0 |
| Debian 11 | ruby-rack | 2.1.4-3+deb11u4 |
| Debian 12 | ruby-rack | 2.2.20-0+deb12u1 |
| Debian 13 | ruby-rack | 3.0.8-2 |
| Debian 14 | ruby-rack | 3.0.8-2 |
| Red Hat Enterprise Linux 10.0 | cockpit-ha-cluster | 0:0.12.0-3.el10_0.3 |
| Red Hat Enterprise Linux 10.0 | pcs | 0:0.12.0-3.el10_0.3 |
| Red Hat Enterprise Linux 10.0 | pcs-snmp | 0:0.12.0-3.el10_0.3 |
| Red Hat Enterprise Linux 10.1 | cockpit-ha-cluster | 0:0.12.1-1.el10_1.1 |
| Red Hat Enterprise Linux 10.1 | pcs | 0:0.12.1-1.el10_1.1 |
| Red Hat Enterprise Linux 10.1 | pcs-snmp | 0:0.12.1-1.el10_1.1 |
| Red Hat Enterprise Linux 8 | pcs | 0:0.10.18-2.el8_10.7 |
| Red Hat Enterprise Linux 8 | pcs-snmp | 0:0.10.18-2.el8_10.7 |
| Red Hat Enterprise Linux 9 | pcs | 0:0.11.10-1.el9_7.1 |
| Red Hat Enterprise Linux 9 | pcs | 0:0.11.9-2.el9_6.2 |
| Red Hat Enterprise Linux 9 | pcs-snmp | 0:0.11.9-2.el9_6.2 |
| Red Hat Enterprise Linux 9 | pcs-snmp | 0:0.11.10-1.el9_7.1 |
| Red Hat rhel aus 8.4 | pcs | 0:0.10.8-1.el8_4.8 |
| Red Hat rhel aus 8.4 | pcs-snmp | 0:0.10.8-1.el8_4.8 |
| Red Hat rhel e4s 8.6 | pcs | 0:0.10.12-6.el8_6.10 |
| Red Hat rhel e4s 8.6 | pcs-snmp | 0:0.10.12-6.el8_6.10 |
| Red Hat rhel e4s 8.8 | pcs | 0:0.10.15-4.el8_8.9 |
| Red Hat rhel e4s 8.8 | pcs-snmp | 0:0.10.15-4.el8_8.9 |
| Red Hat rhel e4s 9.0 | pcs | 0:0.11.1-10.el9_0.9 |
| Red Hat rhel e4s 9.0 | pcs-snmp | 0:0.11.1-10.el9_0.9 |
| Red Hat rhel e4s 9.2 | pcs | 0:0.11.4-7.el9_2.6 |
| Red Hat rhel e4s 9.2 | pcs-snmp | 0:0.11.4-7.el9_2.6 |
| Red Hat rhel eus 9.4 | pcs | 0:0.11.7-2.el9_4.5 |
| Red Hat rhel eus 9.4 | pcs-snmp | 0:0.11.7-2.el9_4.5 |
| Red Hat rhel eus long life 8.4 | pcs | 0:0.10.8-1.el8_4.8 |
| Red Hat rhel eus long life 8.4 | pcs-snmp | 0:0.10.8-1.el8_4.8 |
| Red Hat rhel tus 8.6 | pcs | 0:0.10.12-6.el8_6.10 |
| Red Hat rhel tus 8.6 | pcs-snmp | 0:0.10.12-6.el8_6.10 |
| Red Hat rhel tus 8.8 | pcs | 0:0.10.15-4.el8_8.9 |
| Red Hat rhel tus 8.8 | pcs-snmp | 0:0.10.15-4.el8_8.9 |
| Red Hat satellite 6.15 | foreman | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-cli | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-debug | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-dynflow-sidekiq | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-ec2 | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-journald | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-libvirt | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-openstack | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-ovirt | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-pcp | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-postgresql | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-redis | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-service | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-telemetry | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | foreman-vmware | 0:3.9.1.13-1.el8sat |
| Red Hat satellite 6.15 | rubygem-rack | 0:2.2.20-1.el8sat |
| Red Hat satellite 6.16 | foreman | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-cli | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-cli | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-debug | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-debug | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-dynflow-sidekiq | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-dynflow-sidekiq | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-ec2 | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-ec2 | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-journald | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-journald | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-libvirt | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-libvirt | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-openstack | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-openstack | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-ovirt | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-ovirt | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-pcp | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-pcp | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-postgresql | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-postgresql | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-redis | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-redis | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-service | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-service | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-telemetry | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-telemetry | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | foreman-vmware | 0:3.12.0.11-1.el8sat |
| Red Hat satellite 6.16 | foreman-vmware | 0:3.12.0.11-1.el9sat |
| Red Hat satellite 6.16 | rubygem-rack | 0:2.2.20-1.el9sat |
| Red Hat satellite 6.16 | rubygem-rack | 0:2.2.20-1.el8sat |
| Red Hat satellite 6.17 | foreman | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-cli | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-debug | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-dynflow-sidekiq | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-ec2 | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-journald | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-libvirt | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-openstack | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-ovirt | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-pcp | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-postgresql | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-redis | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-service | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-telemetry | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | foreman-vmware | 0:3.14.0.10-1.el9sat |
| Red Hat satellite 6.17 | rubygem-rack | 0:2.2.20-1.el9sat |
| Red Hat satellite capsule 6.15 | foreman | 0:3.9.1.13-1.el8sat |
| Red Hat satellite capsule 6.15 | foreman-debug | 0:3.9.1.13-1.el8sat |
| Red Hat satellite capsule 6.15 | foreman-pcp | 0:3.9.1.13-1.el8sat |
| Red Hat satellite capsule 6.15 | rubygem-rack | 0:2.2.20-1.el8sat |
| Red Hat satellite capsule 6.16 | foreman | 0:3.12.0.11-1.el8sat |
| Red Hat satellite capsule 6.16 | foreman | 0:3.12.0.11-1.el9sat |
| Red Hat satellite capsule 6.16 | foreman-debug | 0:3.12.0.11-1.el8sat |
| Red Hat satellite capsule 6.16 | foreman-debug | 0:3.12.0.11-1.el9sat |
| Red Hat satellite capsule 6.16 | foreman-pcp | 0:3.12.0.11-1.el9sat |
| Red Hat satellite capsule 6.16 | foreman-pcp | 0:3.12.0.11-1.el8sat |
| Red Hat satellite capsule 6.16 | rubygem-rack | 0:2.2.20-1.el9sat |
| Red Hat satellite capsule 6.16 | rubygem-rack | 0:2.2.20-1.el8sat |
| Red Hat satellite capsule 6.17 | foreman | 0:3.14.0.10-1.el9sat |
| Red Hat satellite capsule 6.17 | foreman-debug | 0:3.14.0.10-1.el9sat |
| Red Hat satellite capsule 6.17 | foreman-pcp | 0:3.14.0.10-1.el9sat |
| Red Hat satellite capsule 6.17 | rubygem-rack | 0:2.2.20-1.el9sat |
| Red Hat satellite utils 6.15 | foreman | 0:3.9.1.13-1.el8sat |
| Red Hat satellite utils 6.15 | foreman-cli | 0:3.9.1.13-1.el8sat |
| Red Hat satellite utils 6.16 | foreman | 0:3.12.0.11-1.el9sat |
| Red Hat satellite utils 6.16 | foreman | 0:3.12.0.11-1.el8sat |
| Red Hat satellite utils 6.16 | foreman-cli | 0:3.12.0.11-1.el9sat |
| Red Hat satellite utils 6.16 | foreman-cli | 0:3.12.0.11-1.el8sat |
| Red Hat satellite utils 6.17 | foreman | 0:3.14.0.10-1.el9sat |
| Red Hat satellite utils 6.17 | foreman-cli | 0:3.14.0.10-1.el9sat |
| Rocky Linux 8 | pcs | 0:0.10.18-2.el8_10.7 |
| Rocky Linux 9 | pcs | 0:0.11.10-1.el9_7.1 |
| Rocky Linux 9 | pcs | 0:0.11.9-2.el9_6.2 |
| Ubuntu 22.04 LTS | ruby-rack | 2.1.4-5ubuntu1.2 |
| Ubuntu 24.04 LTS | ruby-rack | 2.2.7-1ubuntu0.4 |
| Ubuntu 24.04 LTS | ruby-rack | 2.2.7-1ubuntu0.5 |
| Ubuntu 25.10 | ruby-rack | 3.1.16-0.1ubuntu0.1 |
| Ubuntu Pro 14.04 LTS | ruby-rack | no fix |
| Ubuntu Pro 16.04 LTS | ruby-rack | no fix |
| Ubuntu Pro 16.04 LTS | ruby-rack | 1.6.4-3ubuntu0.2+esm9 |
| Ubuntu Pro 18.04 LTS | ruby-rack | no fix |
| Ubuntu Pro 18.04 LTS | ruby-rack | 1.6.4-4ubuntu0.2+esm9 |
| Ubuntu Pro 20.04 LTS | ruby-rack | 2.0.7-2ubuntu0.1+esm8 |
| Wolfi | ruby3.2-rack-2.2 | 2.2.22-r0 |
| Wolfi | ruby3.3-rack-2.2 | 2.2.22-r0 |
| Wolfi | ruby3.4-rack-2.2 | 2.2.22-r0 |
| Wolfi | ruby4.0-rack-2.2 | 2.2.22-r0 |
| openSUSE Tumbleweed | rubygem-rack-2.2 | 2.2.18-1.1 |
| openSUSE Tumbleweed | rubygem-rack-2.2 | 2.2.22-1.1 |