ruby-rack: Rack is a modular Ruby web server interface
CVE-2025-59830 is fixed in 4 products on 1 platform, first by DEBIAN-CVE-2025-59830, released September 25, 2025. It is not reported as exploited. Patch Radar priority: High.
Rack is a modular Ruby web server interface. Prior to version 2.2.18,Rack::QueryParser enforces its params_limit only for parameters separatedby &, while still splitting on both & and ;. As a result, attackers coulduse ; separators to bypass the parameter count limit and submit moreparameters than intended. Applications or middleware that directly invokeRack::QueryParser with its default configuration (no explicit delimiter)could be exposed to increased CPU and memory consumption. This can beabused as a limited denial-of-service vector. This issue has been patchedin version 2.2.18.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| cockpit-ha-cluster · almalinux 10 | 0.12.1-1.el10_1.1 | ALSA-2025:21036 | Nov 11, 2025 |
| cockpit-ha-cluster · ol 10 | 0:0.12.0-3.0.1.el10_0.3 | ELSA-2025-19513 | Nov 7, 2025 |
| pcs · RHEL 10 | 0.12.1-1.el10_1.1 | RHSA-2025:21036 | Oct 10, 2025 |
| pcs · RHEL 8 | 0:0.10.18-2.el8_10.7 | RHSA-2025:19719 | Nov 4, 2025 |
| pcs · RHEL 9 | 0:0.11.10-1.el9_7.1 | RHSA-2025:20962 | Nov 11, 2025 |
| pcs · almalinux 8 | 0.10.18-2.el8_10.7.alma.1 | ALSA-2025:19719 | Nov 4, 2025 |
| pcs · almalinux 9 | 0.11.10-1.el9_7.1 | ALSA-2025:20962 | Nov 11, 2025 |
| pcs · ol 10 | 0:0.12.0-3.0.1.el10_0.3 | ELSA-2025-19513 | Nov 7, 2025 |
| pcs · ol 8 | 0:0.10.18-2.0.1.el8_10.7 | ELSA-2025-19719 | Nov 6, 2025 |
| pcs · ol 9 | 0:0.11.9-2.el9_6.2 | ELSA-2025-19512 | Nov 3, 2025 |
| pcs · rocky 8 | 0:0.10.18-2.el8_10.7 | RLSA-2025:19719 | Nov 5, 2025 |
| pcs · rocky 9 | 0:0.11.10-1.el9_7.1 | RLSA-2025:20962 | Nov 21, 2025 |
| pcs-snmp · RHEL 8 | 0:0.10.18-2.el8_10.7 | RHSA-2025:19719 | Nov 4, 2025 |
| pcs-snmp · RHEL 9 | 0:0.11.10-1.el9_7.1 | RHSA-2025:20962 | Nov 11, 2025 |
| pcs-snmp · almalinux 8 | 0.10.18-2.el8_10.7.alma.1 | ALSA-2025:19719 | Nov 4, 2025 |
| pcs-snmp · almalinux 9 | 0.11.10-1.el9_7.1 | ALSA-2025:20962 | Nov 11, 2025 |
| pcs-snmp · ol 10 | 0:0.12.0-3.0.1.el10_0.3 | ELSA-2025-19513 | Nov 7, 2025 |
| pcs-snmp · ol 8 | 0:0.10.18-2.0.1.el8_10.7 | ELSA-2025-19719 | Nov 6, 2025 |
| pcs-snmp · ol 9 | 0:0.11.9-2.el9_6.2 | ELSA-2025-19512 | Nov 3, 2025 |
| ruby-rack · Debian 12.15 (bookworm) | 2.2.20-0+deb12u1 | DEBIAN-CVE-2025-59830 | Sep 25, 2025 |
| ruby-rack · Debian 13.5 (trixie) | 3.0.8-2 | DEBIAN-CVE-2025-59830 | Sep 25, 2025 |
| ruby-rack · Debian 14 | 3.0.8-2 | DEBIAN-CVE-2025-59830 | Sep 25, 2025 |
| ruby-rack · Ubuntu 20.04 LTS (focal) | 2.0.7-2ubuntu0.1+esm8 | ruby-rack 2.0.7-2ubuntu0.1+esm8 | Oct 10, 2025 |
| ruby-rack · Ubuntu 22.04.1 LTS (jammy) | 2.1.4-5ubuntu1.2 | ruby-rack 2.1.4-5ubuntu1.2 | Oct 10, 2025 |
| ruby-rack · Ubuntu 24.04.5 LTS (noble) | 2.2.7-1ubuntu0.4 | ruby-rack 2.2.7-1ubuntu0.4 | Sep 25, 2025 |
| ruby-rack · Ubuntu 25.04 (plucky) | 2.2.7-1.1ubuntu0.25.04.3 | ruby-rack 2.2.7-1.1ubuntu0.25.04.3 | Sep 26, 2025 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.