Most recent entries from all

ALSA-2025:19719 — Important: pcs security update

Affected: AlmaLinux:8: pcs, AlmaLinux:8: pcs-snmp

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

Security Fix(es):

* rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830) * rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770) * rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771) * rack: Rack memory exhaustion denial of service (CVE-2025-61772) * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion (CVE-2025-61919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-14431

BREW-mailcatcher-CVE-2025-61772 — Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

Affected: Homebrew: mailcatcher

## Summary

`Rack::Multipart::Parser` can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (`CRLFCRLF`). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS).

## Details

While reading multipart headers, the parser waits for `CRLFCRLF` using:

```ruby @sbuf.scan_until(/(.*?\r\n)\r\n/m) ```

If the terminator never appears, it continues appending data (`@sbuf.concat(content)`) indefinitely. There is no limit on accumulated header bytes, so a single malformed part can consume memory proportional to the request body size.

## Impact

Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected.

## Mitigation

* Upgrade to a patched Rack version that caps per-part header size (e.g., 64 KiB). * Until then, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx `client_max_body_size`).

certfr-2025-avi-0967 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2025-avi-0967

Withdrawn: CLEANSTART-2026-GE08280 — Ruby JSON is a JSON implementation for Ruby

Withdrawn by the publisher.

Affected: CleanStart: logstash-fips

Multiple security vulnerabilities affect the logstash-fips package. Ruby JSON is a JSON implementation for Ruby. See references for individual vulnerability details.

EUVD-2026-254331

fkie_cve-2025-61772

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (`CRLFCRLF`). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected. Versions 2.2.19, 3.1.17, and 3.2.2 cap per-part header size (e.g., 64 KiB). As a workaround, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx `client_max_body_size`).

GHSA-wpv5-97wm-hp9c — Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

Affected: RubyGems: rack

## Summary

## Details

While reading multipart headers, the parser waits for `CRLFCRLF` using:

```ruby @sbuf.scan_until(/(.*?\r\n)\r\n/m) ```

## Impact

## Mitigation

* Upgrade to a patched Rack version that caps per-part header size (e.g., 64 KiB). * Until then, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx `client_max_body_size`).

openSUSE-SU-2025:15621-1 — ruby3.4-rubygem-rack-2.2-2.2.19-1.1 on GA media

ruby3.4-rubygem-rack-2.2-2.2.19-1.1 on GA media

RHSA-2025:19513 — Red Hat Security Advisory: pcs security update

rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) rack: Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) rack: Rack memory exhaustion denial of service rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion

UBUNTU-CVE-2025-61772

Affected: Ubuntu:Pro:14.04:LTS: ruby-rack, Ubuntu:Pro:16.04:LTS: ruby-rack, Ubuntu:Pro:18.04:LTS: ruby-rack, Ubuntu:Pro:20.04:LTS: ruby-rack, Ubuntu:22.04:LTS: ruby-rack, Ubuntu:24.04:LTS: ruby-rack, Ubuntu:25.10: ruby-rack

WID-SEC-W-2025-2482 — Red Hat Enterprise Linux: Mehrere Schwachstellen ermöglichen Denial of Service

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.