# CVE-2025-46727: ruby-rack: Rack is a modular Ruby web server interface CVE-2025-46727 is fixed in 6 products on 1 platform, first by ruby-rack 2.0.7-2ubuntu0.1+esm7, released May 7, 2025. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2025-46727 - Priority: High - CVSS: 7.5 (Medium) - EPSS: 0.0123 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: May 7, 2025 ## Description Rack is a modular Ruby web server interface. Prior to versions 2.2.14,3.0.16, and 3.1.14, `Rack::QueryParser` parses query strings and`application/x-www-form-urlencoded` bodies into Ruby data structureswithout imposing any limit on the number of parameters, allowing attackersto send requests with extremely large numbers of parameters. Thevulnerability arises because `Rack::QueryParser` iterates over each`&`-separated key-value pair and adds it to a Hash without enforcing anupper bound on the total number of parameters. This allows an attacker tosend a single request containing hundreds of thousands (or more) ofparameters, which consumes excessive memory and CPU during parsing. Anattacker can trigger denial of service by sending specifically crafted HTTPrequests, which can cause memory exhaustion or pin CPU resources, stallingor crashing the Rack server. This results in full service disruption untilthe affected worker is restarted. Versions 2.2.14, 3.0.16, and 3.1.14 fixthe issue. Some other mitigations are available. One may use middleware toenforce a maximum query string size or parameter count, or employ a reverseproxy (such as Nginx) to limit request sizes and reject oversized querystrings or bodies. Limiting request body sizes and query string lengths atthe web server or CDN level is an effective mitigation. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | cockpit-ha-cluster ol 10 | 0:0.12.0-3.el10_0.2 | [ELSA-2025-8319](https://patchblox.com/security/data/fix/linux/elsa-2025-8319.md) | Jul 2, 2025 | | Linux | pcs RHEL 10 | 0.12.0-3.el10_0.2 | [RHSA-2025:8319](https://patchblox.com/security/data/fix/linux/rhsa-2025-8319.md) | May 7, 2025 | | Linux | pcs RHEL 8 | 0:0.10.18-2.el8_10.5 | [RHSA-2025:8254](https://patchblox.com/security/data/fix/linux/rhsa-2025-8254.md) | May 28, 2025 | | Linux | pcs RHEL 9 | 0:0.11.9-2.el9_6.1 | [RHSA-2025:8256](https://patchblox.com/security/data/fix/linux/rhsa-2025-8256.md) | May 28, 2025 | | Linux | pcs almalinux 8 | 0.10.18-2.el8_10.5.alma.1 | [ALSA-2025:8254](https://patchblox.com/security/data/fix/linux/alsa-2025-8254.md) | May 28, 2025 | | Linux | pcs ol 10 | 0:0.12.0-3.el10_0.2 | [ELSA-2025-8319](https://patchblox.com/security/data/fix/linux/elsa-2025-8319.md) | Jul 2, 2025 | | Linux | pcs ol 8 | 0:0.10.18-2.0.1.el8_10.5 | [ELSA-2025-8254](https://patchblox.com/security/data/fix/linux/elsa-2025-8254.md) | May 28, 2025 | | Linux | pcs ol 9 | 0:0.11.9-2.el9_6.1 | [ELSA-2025-8256](https://patchblox.com/security/data/fix/linux/elsa-2025-8256.md) | May 29, 2025 | | Linux | pcs rocky 8 | 0:0.10.18-2.el8_10.5 | [RLSA-2025:8254](https://patchblox.com/security/data/fix/linux/rlsa-2025-8254.md) | Jul 29, 2025 | | Linux | pcs rocky 9 | 0:0.11.9-2.el9_6.1 | [RLSA-2025:8256](https://patchblox.com/security/data/fix/linux/rlsa-2025-8256.md) | Oct 4, 2025 | | Linux | pcs-snmp RHEL 8 | 0:0.10.18-2.el8_10.5 | [RHSA-2025:8254](https://patchblox.com/security/data/fix/linux/rhsa-2025-8254.md) | May 28, 2025 | | Linux | pcs-snmp RHEL 9 | 0:0.11.9-2.el9_6.1 | [RHSA-2025:8256](https://patchblox.com/security/data/fix/linux/rhsa-2025-8256.md) | May 28, 2025 | | Linux | pcs-snmp almalinux 8 | 0.10.18-2.el8_10.5.alma.1 | [ALSA-2025:8254](https://patchblox.com/security/data/fix/linux/alsa-2025-8254.md) | May 28, 2025 | | Linux | pcs-snmp ol 10 | 0:0.12.0-3.el10_0.2 | [ELSA-2025-8319](https://patchblox.com/security/data/fix/linux/elsa-2025-8319.md) | Jul 2, 2025 | | Linux | pcs-snmp ol 8 | 0:0.10.18-2.0.1.el8_10.5 | [ELSA-2025-8254](https://patchblox.com/security/data/fix/linux/elsa-2025-8254.md) | May 28, 2025 | | Linux | pcs-snmp ol 9 | 0:0.11.9-2.el9_6.1 | [ELSA-2025-8256](https://patchblox.com/security/data/fix/linux/elsa-2025-8256.md) | May 29, 2025 | | Linux | rmt-server opensuse-leap 15.6 | 2.23-150500.3.34.2 | [SUSE-SU-2025:02564-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02564-1.md) | Jul 31, 2025 | | Linux | rmt-server sles 15.6 | 2.23-150500.3.34.2 | [SUSE-SU-2025:02564-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02564-1.md) | Jul 31, 2025 | | Linux | rmt-server sles 15.7 | 2.23-150700.3.6.1 | [SUSE-SU-2025:02330-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02330-1.md) | Jul 16, 2025 | | Linux | ruby-rack Debian 12.15 (bookworm) | 2.2.20-0+deb12u1 | [DEBIAN-CVE-2025-46727](https://patchblox.com/security/data/fix/linux/debian-cve-2025-46727.md) | May 7, 2025 | | Linux | ruby-rack Debian 13.5 (trixie) | 3.1.16-0.1 | [DEBIAN-CVE-2025-46727](https://patchblox.com/security/data/fix/linux/debian-cve-2025-46727.md) | May 7, 2025 | | Linux | ruby-rack Debian 14 | 3.1.16-0.1 | [DEBIAN-CVE-2025-46727](https://patchblox.com/security/data/fix/linux/debian-cve-2025-46727.md) | May 7, 2025 | | Linux | ruby-rack Ubuntu 20.04 LTS (focal) | 2.0.7-2ubuntu0.1+esm7 | [ruby-rack 2.0.7-2ubuntu0.1+esm7](https://patchblox.com/security/data/fix/linux/ubuntu-focal-ruby-rack-2.0.7-2ubuntu0.1-esm7.md) | May 7, 2025 | | Linux | ruby-rack Ubuntu 22.04.1 LTS (jammy) | 2.1.4-5ubuntu1.1+esm2 | [ruby-rack 2.1.4-5ubuntu1.1+esm2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-ruby-rack-2.1.4-5ubuntu1.1-esm2.md) | May 7, 2025 | | Linux | ruby-rack Ubuntu 24.04.5 LTS (noble) | 2.2.7-1ubuntu0.3 | [ruby-rack 2.2.7-1ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ruby-rack-2.2.7-1ubuntu0.3.md) | May 7, 2025 | | Linux | ruby-rack Ubuntu 24.10 (oracular) | 2.2.7-1.1ubuntu0.2 | [ruby-rack 2.2.7-1.1ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-ruby-rack-2.2.7-1.1ubuntu0.2.md) | May 8, 2025 | | Linux | ruby-rack Ubuntu 25.04 (plucky) | 2.2.7-1.1ubuntu0.25.04.1 | [ruby-rack 2.2.7-1.1ubuntu0.25.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-ruby-rack-2.2.7-1.1ubuntu0.25.04.1.md) | May 8, 2025 | | Linux | ruby-rack Ubuntu 25.10 (questing) | 3.1.16-0.1 | [ruby-rack 3.1.16-0.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-ruby-rack-3.1.16-0.1.md) | May 7, 2025 | | Linux | rubygem-rack opensuse-leap 15.6 | 2.0.8-150000.3.31.1 | [SUSE-SU-2025:01586-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01586-1.md) | May 19, 2025 | | Linux | rubygem-rack sles 15.6 | 2.0.8-150000.3.31.1 | [SUSE-SU-2025:01586-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-01586-1.md) | May 19, 2025 | | Linux | rubygem-rack sles 15.7 | 2.0.8-150000.3.31.1 | [SUSE-SU-2025:01586-2](https://patchblox.com/security/data/fix/linux/suse-su-2025-01586-2.md) | Jun 3, 2025 | --- Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.