CVE-2025-61771: 
Ruby vulnerability analysis and mitigation

Rack, a modular Ruby web server interface, was found to contain a vulnerability (CVE-2025-61771) in versions prior to 2.2.19, 3.1.17, and 3.2.2. The vulnerability exists in the Rack::Multipart::Parser component which stores non-file form fields entirely in memory as Ruby String objects without size limitations. This vulnerability was disclosed on October 7, 2025, and affects all Rack applications that process multipart form submissions (GitHub Advisory).

The vulnerability stems from the way Rack::Multipart::Parser handles non-file form fields in multipart/form-data requests. During multipart parsing, while file parts are streamed to temporary files, non-file parts are buffered into memory using body = String.new without any size restrictions. This implementation allows a single large text field to be loaded entirely into process memory before being added to params. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating it can be exploited remotely with low complexity and requires no privileges or user interaction (GitHub Advisory).

The vulnerability can lead to denial of service (DoS) through memory exhaustion. Attackers can send large non-file fields to trigger excessive memory usage, with the impact scaling based on request size and concurrency. This can result in worker crashes or severe garbage-collection overhead, affecting service availability. The vulnerability's impact is particularly significant as it affects all Rack applications that process multipart form submissions (GitHub Advisory).

The vulnerability has been patched in versions 2.2.19, 3.1.17, and 3.2.2, which enforce a reasonable size cap (e.g., 2 MiB) for non-file fields. For users unable to upgrade immediately, workarounds include restricting maximum request body size at the web-server or proxy layer (e.g., using Nginx client_max_body_size) and implementing validation to reject unusually large form fields at the application level (GitHub Advisory).