{"id":"CVE-2025-59830","published":"2025-09-25T14:37:06Z","modified":"2025-09-25T16:16:15Z","title":"Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters","vendor":"rack","product":"rack","tier":"tail","description":{"text":"Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00573,"percentile":0.47381,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"},{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"}],"references":[{"url":"https://github.com/rack/rack/security/advisories/GHSA-625h-95r8-8xpm","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/rack/rack/commit/54e4ffdd5affebcb0c015cc6ae74635c0831ed71","tags":["x_refsource_MISC"]}],"priority":{"score":14.7,"factors":[{"name":"EPSS percentile","points":9.48},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"rack","affectedVersions":[{"vendor":"rack","product":"rack","versions":["< 2.2.18"]}],"affected":[{"ecosystem":"RubyGems","package":"rack","vulnerableRanges":["<2.2.18"],"patched":["2.2.18"],"from":["GHSA-625h-95r8-8xpm"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-31103","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-30122","published":"2022-12-05","fixed":"2.2.3.1","kev":false},{"cve":"CVE-2022-30123","published":"2022-12-05","fixed":"2.2.3.1","kev":false},{"cve":"CVE-2025-32441","published":"2025-05-07","fixed":"2.2.14","kev":false},{"cve":"CVE-2025-59830","published":"2025-09-25","fixed":"2.2.18","kev":false},{"cve":"CVE-2022-44570","published":"2023-02-09","fixed":"3.0.4.1","kev":false},{"cve":"CVE-2022-44571","published":"2023-02-09","fixed":"3.0.4.1","kev":false},{"cve":"CVE-2022-44572","published":"2023-02-09","fixed":"3.0.4.1","kev":false},{"cve":"CVE-2025-46727","published":"2025-05-07","fixed":"3.1.14","kev":false,"link":{"from":"CVE-2025-46727","to":"CVE-2025-59830","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:rack","fromFixed":"2.2.14","toFixed":"2.2.18","daysApart":141}]}},{"cve":"CVE-2025-61770","published":"2025-10-07","fixed":"3.2.2","kev":false,"link":{"from":"CVE-2025-59830","to":"CVE-2025-61770","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:rack","fromFixed":"2.2.18","toFixed":"2.2.19","daysApart":12}]}},{"cve":"CVE-2025-61771","published":"2025-10-07","fixed":"3.2.2","kev":false,"link":{"from":"CVE-2025-59830","to":"CVE-2025-61771","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:rack","fromFixed":"2.2.18","toFixed":"2.2.19","daysApart":12}]}},{"cve":"CVE-2025-61772","published":"2025-10-07","fixed":"3.2.2","kev":false,"link":{"from":"CVE-2025-59830","to":"CVE-2025-61772","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:rack","fromFixed":"2.2.18","toFixed":"2.2.19","daysApart":12}]}}],"package":"RubyGems:rack"}}