Introduction
A single HTTP request can bring down a Ruby web application if it exploits a flaw in how multipart form data is parsed. CVE-2025-61770 is a high-impact memory exhaustion vulnerability in Rack, the core Ruby web server interface used by Ruby on Rails, Sinatra, and many other frameworks. Any internet-facing application that accepts multipart form data and runs a vulnerable version is at risk.
About Rack: Rack is the de facto standard interface between Ruby web frameworks and web servers, used in millions of deployments worldwide. So much of the Ruby web ecosystem is built on it that its security and stability directly affect a wide range of production applications.
Technical Information
CVE-2025-61770 is rooted in the implementation of Rack::Multipart::Parser. When it handles multipart HTTP requests (commonly used for file uploads), the parser reads the entire preamble (the bytes before the first boundary) and buffers it directly in memory. Affected versions put no size check or limit on this buffer.
An attacker can send a multipart/form-data request with an extremely large preamble, followed by a valid boundary. The parser allocates memory for the whole preamble, whatever its size. With enough concurrent requests or a large enough preamble, this can:
- Exhaust available memory, causing process termination (OOM)
- Trigger frequent garbage collection, leading to severe slowdowns
- Crash worker processes or degrade application performance
The risk is proportional to the allowed request size and server concurrency. The vulnerability is remotely exploitable and needs no authentication or knowledge of application internals. It is classified under CWE-400 (Uncontrolled Resource Consumption).
The patched versions (2.2.19, 3.1.17, 3.2.2) either put a hard limit on preamble size (for example, 16 KiB) or discard the preamble data entirely, so the parser can no longer allocate memory without bound.
The official advisories and commits include no public code snippets of the vulnerable or fixed code.
Affected Systems and Versions
- Rack versions prior to 2.2.19
- Rack versions prior to 3.1.17
- Rack versions prior to 3.2.2
Any configuration that processes multipart/form-data requests on these versions is vulnerable, including the default configurations of Ruby on Rails and Sinatra applications.
Vendor Security History
Rack has had multipart parsing vulnerabilities before. Notable examples include:
- CVE-2022-30122: Multipart parser DoS
- CVE-2025-49007: Multipart header ReDoS
The Rack team typically responds quickly with patches and coordinated advisories, which it publishes on GitHub and through industry channels. Experienced Ruby developers maintain the project, and it is considered mature, but multipart parsing keeps turning up issues.
