Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
A `Rack` vulnerability (CVE-2025-59830) allows `params_limit` bypass in `Rack::QueryParser` via semicolon-separated parameters. Review `Rack` configurations for potential DoS risks. #infosec #webdev #security https://www.pulsepatch.io/posts/cve-2025-59830-rack-queryparser-bypass
Post summary
The post announces CVE-2025-59830 as a Rack::QueryParser params_limit bypass, recommending configuration review for potential DoS.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | rack | rack | - | ruby | - |