CVE-2025-59830 is a high-severity (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in rack. A fix is available for rack — see the affected versions and patch details below.
Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2025-59830.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
rackReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.
Description
Summary
Rack::QueryParser in version < 2.2.18 enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended.
Details
The issue arises because Rack::QueryParser#check_query_string counts only & characters when determining the number of parameters, but the default separator regex DEFAULT_SEP = /[&;] */n splits on both & and ;. This mismatch means that queries using ; separators were not included in the parameter count, allowing params_limit to be bypassed.
Other safeguards (bytesize_limit and key_space_limit) still applied, but did not prevent this particular bypass.
Impact
Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector.
Rack::Request, the primary entry point for typical Rack applications, uses QueryParser in a safe way and does not appear vulnerable by default. As such, the severity is considered low, with the impact limited to edge cases where QueryParser is used directly.
Mitigation
- Upgrade to a patched version of Rack where both
∧are counted consistently towardparams_limit. - If upgrading is not immediately possible, configure
QueryParserwith an explicit delimiter (e.g.,&) to avoid the mismatch. - As a general precaution, enforce query string and request size limits at the web server or proxy layer (e.g., Nginx, Apache, or a CDN) to mitigate excessive parsing overhead.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 💎RubyGems | rack | all versions | 2.2.18bundle update rack --conservative |
Affected Products
rackrackDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for rack, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update rack to 2.2.18 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-59830 is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
The overall severity of this flaw is Moderate, because most Rack applications are not directly impacted. The vulnerability primarily affects applications or middleware that invoke Rack::QueryParser directly using its default configuration, which accepts both & and ; as parameter delimiters. This behavior can lead to…
No action is required for typical Rack applications that use the framework’s default request-handling mechanisms, as these are not impacted. For custom implementations or middleware that directly invoke Rack::QueryParser, administrators should: Use explicit delimiters: Configure QueryParser to use a specific delimiter (e.g. &) rather than accepting both & and ;. Limit request size and parameters: Enforce request size and parameter count limits at upstream layers (such as a web server, reverse proxy, or WAF) to prevent excessive resource consumption. Prefer safe APIs: Use Rack::Request or other higher-level request parsing APIs, which apply safe defaults and avoid this vulnerability.Source: Red Hat security advisory for CVE-2025-59830 (CC BY 4.0)
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Enterprise Linux 10 | pcs-0:0.12.0-3.el10_0.3 | RHSA-2025:19513 |
| Red Hat Enterprise Linux 10 | pcs-0:0.12.1-1.el10_1.1 | RHSA-2025:21036 |
| Red Hat Enterprise Linux 8 | pcs-0:0.10.18-2.el8_10.7 | RHSA-2025:19719 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | pcs-0:0.10.8-1.el8_4.8 | RHSA-2025:19948 |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | pcs-0:0.10.12-6.el8_6.10 | RHSA-2025:19734 |
| Red Hat Enterprise Linux 8.8 Telecommunications Update Service | pcs-0:0.10.15-4.el8_8.9 | RHSA-2025:19647 |
| Red Hat Enterprise Linux 9 | pcs-0:0.11.9-2.el9_6.2 | RHSA-2025:19512 |
| Red Hat Enterprise Linux 9 | pcs-0:0.11.10-1.el9_7.1 | RHSA-2025:20962 |
Frequently Asked Questions
Is CVE-2025-59830 in your dependencies?
Find it across RubyGems, including transitive dependencies.