CVE-2025-59830: Parameter Bypass in Ruby Rack

The core of the vulnerability lies in how Rack::QueryParser handles query string parameters. While it enforces a params_limit to prevent excessive parameter submissions, the code incorrectly counts parameters only when separated by ampersands (&). However, the underlying parsing logic also splits the query string on semicolons (;). This discrepancy allows an attacker to craft a malicious query string using semicolons to bypass the parameter limit and submit a significantly larger number of parameters than intended. This can lead to excessive resource consumption on the server, potentially causing a denial of service. The impact is amplified in applications that heavily rely on query string parameters for processing, as a single malicious request could overwhelm the server.

1. Reserved2025-09-22
2. Published2025-09-25
3. Modified2026-04-04
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-59830 is to upgrade to Rack version 2.2.18 or later, which includes the fix for this parameter bypass vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter out query strings containing excessive semicolons or parameters. Alternatively, you could implement a proxy-level filter to limit the number of parameters allowed in incoming requests. For detection, monitor application logs for unusually large query strings or requests with a high number of parameters. After upgrading, confirm the fix by sending a crafted query string with a large number of parameters separated by semicolons and verifying that the params_limit is enforced.