CVE-2025-59830: 
Ruby vulnerability analysis and mitigation

Rack::QueryParser in version < 2.2.18 contains a high-severity vulnerability (CVE-2025-59830) that was discovered and disclosed on September 25, 2025. The vulnerability affects the Rack Ruby web server interface, specifically in how it handles parameter limits in query string parsing. The flaw allows attackers to bypass the parameter count limit by using semicolon separators instead of ampersands, potentially leading to denial-of-service conditions (GitHub Advisory).

The vulnerability exists because Rack::QueryParser#checkquerystring counts only ampersand (&) characters when determining the number of parameters, while the default separator regex DEFAULT_SEP = /[&;] */n splits on both ampersands and semicolons. This mismatch allows queries using semicolon separators to bypass the parameter count limit. The vulnerability has been assigned a CVSS v3.1 score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue has been classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling) (GitHub Advisory, Miggo).

Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption, which can be exploited as a limited denial-of-service vector. However, Rack::Request, the primary entry point for typical Rack applications, uses QueryParser in a safe way and is not vulnerable by default. The impact is considered limited to edge cases where QueryParser is used directly (GitHub Advisory).

The vulnerability has been patched in Rack version 2.2.18, where both ampersands and semicolons are counted consistently toward params_limit. For systems that cannot immediately upgrade, a workaround is available by configuring QueryParser with an explicit delimiter (e.g., &). Additionally, it is recommended to enforce query string and request size limits at the web server or proxy layer (e.g., Nginx, Apache, or a CDN) to mitigate excessive parsing overhead (GitHub Advisory).

The vulnerability has been widely reported across security platforms and has garnered attention from the cybersecurity community. Security researchers and platforms like Daily CyberSecurity have classified this as a high-severity issue requiring immediate attention (Daily CyberSecurity).