CVE-2025-61770: DoS in Rack Multipart Parser

The core issue lies in the Rack::Multipart::Parser's handling of the multipart preamble. The parser buffers the entire preamble in memory without enforcing a size limit. A malicious client can craft a request with an exceptionally large preamble, followed by a valid boundary. This excessive memory consumption can lead to an out-of-memory (OOM) condition, resulting in the Rack application process crashing or becoming unresponsive. The blast radius extends to any application relying on Rack for handling multipart requests, potentially impacting multiple services and users. This vulnerability is similar to other memory exhaustion attacks where an attacker overwhelms a system's resources to cause a denial of service.

1. Reserved2025-09-30
2. Published2025-10-07
3. Modified2026-02-04
4. EPSS updated2026-03-23

The primary mitigation is to upgrade to Rack version 2.2.19 or later, which includes a fix for this vulnerability. If an immediate upgrade is not feasible, consider implementing temporary workarounds. One approach is to configure the web server or application to limit the maximum request size for multipart uploads. Another potential mitigation involves using a WAF (Web Application Firewall) to filter requests with excessively large multipart preambles. Monitor application logs for signs of memory exhaustion or process crashes, which could indicate exploitation attempts. After upgrade, confirm by sending a test multipart request with a large preamble and verifying that the application does not crash.