Rack hat eine unsichere Standardeinstellung in Rack::QueryParser, die eine Umgehung von params_limit über semikolonseparierte Parameter ermöglicht

Exploitation of CVE-2025-59830 could allow an attacker to submit a significantly larger number of parameters than intended to a web application. This could lead to denial-of-service (DoS) conditions by overwhelming the application's resources, or potentially to information disclosure or other vulnerabilities if the application improperly handles a large number of parameters. The blast radius is limited to the application using the vulnerable Rack version, but the impact can be significant if the application is critical.

Applications built on Ruby that utilize the Rack library, particularly those that process user-supplied data through query strings without proper input validation, are at risk. Shared hosting environments where multiple applications share the same Rack installation are also vulnerable, as a compromised application could potentially impact others.

• ruby / server:

ps aux | grep rack

• ruby / server:

journalctl -u rack -g "params_limit"

• generic web:

curl -I 'http://your-rack-app.com/?param1=value1&param2=value2;param3=value3&param4=value4'

• generic web:

grep -i 'params_limit' /var/log/apache2/access.log

1. 2025-09-25Disclosure

   disclosure

1. Reserviert2025-09-22
2. Veröffentlicht2025-09-25
3. Geändert2026-04-04
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-59830 is to upgrade the Rack library to version 2.2.18 or later. If upgrading is not immediately possible, consider implementing input validation and sanitization on the application side to limit the number of parameters accepted. WAF rules can be configured to block requests with excessive parameters using semicolon separators. After upgrading, confirm the fix by sending a request with a large number of parameters separated by semicolons and verifying that the parameter count limit is enforced.