Rack heeft een onveilige standaard in Rack::QueryParser die een params_limit omzeiling mogelijk maakt via puntkomma-gescheiden parameters

The core of the vulnerability lies in how Rack::QueryParser handles query string parameters. While it enforces a params_limit to prevent excessive parameter submissions, the code incorrectly counts parameters only when separated by ampersands (&). However, the underlying parsing logic also splits the query string on semicolons (;). This discrepancy allows an attacker to craft a malicious query string using semicolons to bypass the parameter limit and submit a significantly larger number of parameters than intended. This can lead to excessive resource consumption on the server, potentially causing a denial of service. The impact is amplified in applications that heavily rely on query string parameters for processing, as a single malicious request could overwhelm the server.

Applications built on Ruby that utilize the Rack library, particularly those that process user-supplied data through query strings without proper input validation, are at risk. Shared hosting environments where multiple applications share the same Rack installation are also vulnerable, as a compromised application could potentially impact others.

• ruby / server:

ps aux | grep rack

• ruby / server:

journalctl -u rack -g "params_limit"

• generic web:

curl -I 'http://your-rack-app.com/?param1=value1&param2=value2;param3=value3&param4=value4'

• generic web:

grep -i 'params_limit' /var/log/apache2/access.log

1. 2025-09-25Disclosure

   disclosure

1. Gereserveerd2025-09-22
2. Gepubliceerd2025-09-25
3. Gewijzigd2026-04-04
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-59830 is to upgrade to Rack version 2.2.18 or later, which includes the fix for this parameter bypass vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter out query strings containing excessive semicolons or parameters. Alternatively, you could implement a proxy-level filter to limit the number of parameters allowed in incoming requests. For detection, monitor application logs for unusually large query strings or requests with a high number of parameters. After upgrading, confirm the fix by sending a crafted query string with a large number of parameters separated by semicolons and verifying that the params_limit is enforced.