UBUNTU-CVE-2025-61772

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2025-61772
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-61772.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2025-61772
Upstream
Published
2025-10-07T15:16:00Z
Modified
2025-10-10T15:30:19Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, Rack::Multipart::Parser can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (CRLFCRLF). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected. Versions 2.2.19, 3.1.17, and 3.2.2 cap per-part header size (e.g., 64 KiB). As a workaround, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx client_max_body_size).

References

Affected packages

Ubuntu:22.04:LTS

ruby-rack

Package

Name
ruby-rack
Purl
pkg:deb/ubuntu/ruby-rack@2.1.4-5ubuntu1.1?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.1.4-3
2.1.4-4
2.1.4-5
2.1.4-5ubuntu1
2.1.4-5ubuntu1.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.1.4-5ubuntu1.1",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:24.04:LTS

ruby-rack

Package

Name
ruby-rack
Purl
pkg:deb/ubuntu/ruby-rack@2.2.7-1ubuntu0.4?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.2.4-3
2.2.7-1
2.2.7-1ubuntu0.1
2.2.7-1ubuntu0.2
2.2.7-1ubuntu0.3
2.2.7-1ubuntu0.4

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.2.7-1ubuntu0.4",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:25.04

ruby-rack

Package

Name
ruby-rack
Purl
pkg:deb/ubuntu/ruby-rack@2.2.7-1.1ubuntu0.25.04.3?arch=source&distro=plucky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.2.7-1.1
2.2.7-1.1ubuntu0.25.04.1
2.2.7-1.1ubuntu0.25.04.2
2.2.7-1.1ubuntu0.25.04.3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.2.7-1.1ubuntu0.25.04.3",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:25.10

ruby-rack

Package

Name
ruby-rack
Purl
pkg:deb/ubuntu/ruby-rack@3.1.16-0.1?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.2.7-1.1

3.*

3.1.16-0.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "3.1.16-0.1",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:Pro:14.04:LTS

ruby-rack

Package

Name
ruby-rack
Purl
pkg:deb/ubuntu/ruby-rack@1.5.2-3+deb8u3ubuntu1~esm10?arch=source&distro=esm-infra-legacy/trusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.5.2-1
1.5.2-1ubuntu0.1~esm1
1.5.2-3+deb8u3ubuntu1~esm2
1.5.2-3+deb8u3ubuntu1~esm3
1.5.2-3+deb8u3ubuntu1~esm4
1.5.2-3+deb8u3ubuntu1~esm6
1.5.2-3+deb8u3ubuntu1~esm7
1.5.2-3+deb8u3ubuntu1~esm8
1.5.2-3+deb8u3ubuntu1~esm9
1.5.2-3+deb8u3ubuntu1~esm10

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.5.2-3+deb8u3ubuntu1~esm10",
            "binary_name": "librack-ruby"
        },
        {
            "binary_version": "1.5.2-3+deb8u3ubuntu1~esm10",
            "binary_name": "librack-ruby1.8"
        },
        {
            "binary_version": "1.5.2-3+deb8u3ubuntu1~esm10",
            "binary_name": "librack-ruby1.9.1"
        },
        {
            "binary_version": "1.5.2-3+deb8u3ubuntu1~esm10",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:Pro:16.04:LTS

ruby-rack

Package

Name
ruby-rack
Purl
pkg:deb/ubuntu/ruby-rack@1.6.4-3ubuntu0.2+esm8?arch=source&distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.5.2-4
1.6.4-2
1.6.4-3
1.6.4-3ubuntu0.1
1.6.4-3ubuntu0.2
1.6.4-3ubuntu0.2+esm1
1.6.4-3ubuntu0.2+esm2
1.6.4-3ubuntu0.2+esm4
1.6.4-3ubuntu0.2+esm5
1.6.4-3ubuntu0.2+esm6
1.6.4-3ubuntu0.2+esm7
1.6.4-3ubuntu0.2+esm8

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.6.4-3ubuntu0.2+esm8",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:Pro:18.04:LTS

ruby-rack

Package

Name
ruby-rack
Purl
pkg:deb/ubuntu/ruby-rack@1.6.4-4ubuntu0.2+esm8?arch=source&distro=esm-apps/bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.6.4-4
1.6.4-4ubuntu0.1
1.6.4-4ubuntu0.2
1.6.4-4ubuntu0.2+esm1
1.6.4-4ubuntu0.2+esm2
1.6.4-4ubuntu0.2+esm4
1.6.4-4ubuntu0.2+esm5
1.6.4-4ubuntu0.2+esm6
1.6.4-4ubuntu0.2+esm7
1.6.4-4ubuntu0.2+esm8

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "1.6.4-4ubuntu0.2+esm8",
            "binary_name": "ruby-rack"
        }
    ]
}

Ubuntu:Pro:20.04:LTS

ruby-rack

Package

Name
ruby-rack
Purl
pkg:deb/ubuntu/ruby-rack@2.0.7-2ubuntu0.1+esm7?arch=source&distro=esm-apps/focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.0.6-3
2.0.7-2
2.0.7-2ubuntu0.1
2.0.7-2ubuntu0.1+esm1
2.0.7-2ubuntu0.1+esm2
2.0.7-2ubuntu0.1+esm3
2.0.7-2ubuntu0.1+esm4
2.0.7-2ubuntu0.1+esm5
2.0.7-2ubuntu0.1+esm6
2.0.7-2ubuntu0.1+esm7

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.0.7-2ubuntu0.1+esm7",
            "binary_name": "ruby-rack"
        }
    ]
}