Introduction
A single malformed upload can exhaust a Ruby web application's memory and take the service down. CVE-2025-61772 is a critical flaw in how Rack, the backbone of Ruby web servers and frameworks, processes multipart form data. A remote attacker can exhaust server memory by sending multipart requests with incomplete headers, and any application that relies on the vulnerable parser is affected.
Technical Information
The flaw is in the Rack::Multipart::Parser class, which handles multipart form data in HTTP requests. The multipart specification requires each part's headers to end with a blank line (CRLFCRLF). In affected versions, the parser buffers header data in memory until it sees that blank line. If a part's headers never end with it, the parser keeps appending incoming bytes to memory with no upper bound.
An attacker can exploit this by crafting a multipart HTTP request in which one or more parts have headers that never end with CRLFCRLF. The parser then reads and stores all incoming data as header data, and memory use grows without limit. Depending on the server's request size limits and concurrency settings, the attack works with a single large request or with multiple concurrent requests. The process can be killed when it runs out of memory (OOM), or the application can slow down severely.
The root cause is that the header accumulation logic never checks headers against a maximum size. The patched versions add a per-part header size cap (such as 64 KiB), so malformed input can no longer make the parser consume excessive memory.
Affected Systems and Versions
- Rack versions prior to 2.2.19
- Rack versions prior to 3.1.17
- Rack versions prior to 3.2.2
Any Ruby web application that uses one of these Rack versions to handle multipart uploads is vulnerable. The web framework on top (Rails, Sinatra, etc.) makes no difference as long as Rack does the multipart parsing.
Vendor Security History
Rack is a foundational Ruby library that lets Ruby web servers and frameworks interoperate. The project has fixed denial of service and resource exhaustion vulnerabilities before, particularly in multipart and parameter parsing. Recent advisories have covered:
- Multiple DoS vulnerabilities in multipart and query parsing
- Regular expression DoS (ReDoS) issues
- Resource exhaustion flaws (CWE-400)
The Rack maintainers have a published security policy and typically patch the current and previous major-minor release series. They publish security advisories and patches on the project's GitHub repository.
