Rack Security Update: High-Severity Flaw Bypasses Parameter Limit, Exposing Apps to DoS Attacks

The Rack project has released a security update for a high-severity flaw in its query parameter parsing logic that affects Rack versions prior to 2.2.18. The vulnerability, tracked as CVE-2025-59830 with a CVSS score of 7.5 (High), could allow a denial-of-service through increased CPU and memory consumption when attackers bypass the parameter count limit.

According to GHSA-625h-95r8-8xpm, “Rack::QueryParser in version < 2.2.18 enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended.” The article notes that the mismatch arises because Rack splits on both delimiters but counts only &, enabling a flood of parameters via semicolons.

Most Rack-based applications remain safe by default, as Rack::Request uses QueryParser in a safe way and does not appear vulnerable by default. Affected: Rack versions < 2.2.18; Patched: Rack 2.2.18.