Introduction
A single oversized POST request can crash a Ruby web application that relies on an outdated version of Rack. CVE-2025-61919 is a memory exhaustion flaw in Rack's form body parsing, and it directly affects Rails, Sinatra, and Hanami deployments. Rack is the de facto Ruby web server interface and powers millions of web applications and APIs worldwide. Because it is the glue between Ruby frameworks and HTTP servers, a vulnerability in Rack has broad impact across the whole ecosystem.
Technical Information
CVE-2025-61919 is a resource exhaustion vulnerability in how Rack handles application/x-www-form-urlencoded POST bodies. In vulnerable versions, the Rack::Request#POST method reads the entire request body into memory by calling rack.input.read(nil), with no length limit. If an attacker submits a POST request with a very large body, Rack tries to buffer the whole payload in process memory before parsing it. The Ruby process can then consume all available memory and deny service, which may crash the application or the entire server. The read happens before any form parameter validation or application-level logic, so input validation in the application code does not mitigate the issue.
The root cause is that Rack sets no bytesize limit when it reads the request body for form-encoded data. The patched versions of Rack (2.2.20, 3.1.18, and 3.2.3) enforce a limit with query_parser.bytesize_limit. If the request body exceeds this limit, Rack raises an error instead of buffering the entire body, which prevents memory exhaustion. The issue is classified under CWE-400 (Uncontrolled Resource Consumption).
Affected Systems and Versions
CVE-2025-61919 affects Rack versions prior to 2.2.20, 3.1.18, and 3.2.3. Any Ruby web application or API on these versions (or earlier) is vulnerable if it processes application/x-www-form-urlencoded POST requests. That includes default configurations of Rails, Sinatra, Hanami, and other Rack-based frameworks. The deployment environment makes no difference. Bare metal, virtual machines, containers, and PaaS are all exposed if they run an affected Rack version.
Vendor Security History
Rack has a history of resource exhaustion and parsing vulnerabilities. Related issues include CVE-2025-46727 (unbounded parameter parsing) and CVE-2025-61772 (multipart header parsing). The Rack maintainers have consistently issued coordinated advisories and timely patches for these vulnerabilities. Parsing flaws keep recurring, though, which shows how hard it is for a foundational library to handle HTTP input securely.
