Introduction
A single HTTP request can crash a Ruby web application if it exploits a memory allocation flaw in the underlying framework. In CVE-2025-61771, an attacker can use a design choice in Rack's multipart parser to exhaust server memory and deny service to any application that processes multipart form data.
Rack is the de facto standard interface between Ruby web servers and frameworks like Rails, Sinatra, and Hanami. Nearly the whole Ruby ecosystem uses it, so a vulnerability in Rack reaches a wide range of production systems.
Technical information
CVE-2025-61771 is a memory exhaustion vulnerability in the Rack::Multipart::Parser component. The parser handles multipart/form-data requests, which are common for file uploads and complex forms. In affected versions, when the parser meets a non-file form field (a part without a filename parameter), it reads the entire value into memory as a Ruby String object.
This becomes a problem when an attacker submits a multipart request with a very large text field. A field containing hundreds of megabytes of data, for example, will cause Rack to allocate a String of the same size. If the server processes several such requests at once, or if one request contains several oversized fields, process memory can run out quickly. The result can be crashed workers or severe garbage collection overhead, and either one denies service to legitimate users.
The root cause is that non-file fields had no size cap. File uploads are typically streamed or written to disk, but non-file fields had no similar control. Rack versions 2.2.19, 3.1.17, and 3.2.2 fix this with a default 2 MiB cap on the size of non-file fields. The parser rejects requests that exceed this limit early in parsing.
The public advisories include no code snippets. For further technical details, review the commits that implement the fix:
- Commit 589127f4ac8b5cf11cf88fb0cd116ffed4d2181e
- Commit d869fed663b113b95a74ad53e1b5cae6ab31f29e
- Commit e08f78c656c9394d6737c022bde087e0f33336fd
Affected systems and versions
- Rack versions prior to 2.2.19
- Rack versions prior to 3.1.17
- Rack versions prior to 3.2.2
Every Rack application that processes multipart form submissions is affected. That includes applications built on Ruby on Rails, Sinatra, Hanami, and any other framework that uses Rack for HTTP request handling.
Vendor security history
Rack has had several resource exhaustion and denial-of-service vulnerabilities in recent years, including issues in its multipart and query parsers. The project has a history of coordinated patch releases and public security advisories. Previous issues include:
- CVE-2025-46727: Unbounded parameter parsing in Rack::QueryParser
- CVE-2025-49007: ReDoS in Rack::Multipart
- CVE-2022-30122: DoS in multipart parsing
The Rack team typically ships patches promptly and publishes clear upgrade guidance.
