7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-61770

CVE-2025-61770: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)

Summary

Rack::Multipart::Parser buffers the entire multipart preamble (bytes before the first boundary) in memory without any size limit. A client can send a large preamble followed by a valid boundary, causing significant memory use and potential process termination due to out-of-memory (OOM) conditions.

Details

While searching for the first boundary, the parser appends incoming data into a shared buffer (@sbuf.concat(content)) and scans for the boundary pattern:

@sbuf.scan_until(@body_regex)

If the boundary is not yet found, the parser continues buffering data indefinitely. There is no trimming or size cap on the preamble, allowing attackers to send arbitrary amounts of data before the first boundary.

Impact

Remote attackers can trigger large transient memory spikes by including a long preamble in multipart/form-data requests. The impact scales with allowed request sizes and concurrency, potentially causing worker crashes or severe slowdown due to garbage collection.

Mitigation

Upgrade: Use a patched version of Rack that enforces a preamble size limit (e.g., 16 KiB) or discards preamble data entirely per RFC 2046 § 5.1.1.
Workarounds:
- Limit total request body size at the proxy or web server level.
- Monitor memory and set per-process limits to prevent OOM conditions.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-61770

CVE-2025-61770:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
rack	rubygems	< 2.2.19	2.2.19
rack	rubygems	>= 3.1, < 3.1.17	3.1.17
rack	rubygems	>= 3.2, < 3.2.2	3.2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as CVE-2025-61770, is a denial-of-service (DoS) issue in Rack's multipart parsing logic. The root cause is the unbounded buffering of the multipart preamble, which is the data sent by a client before the first boundary in a multipart/form-data request.

The analysis of the provided patches, specifically commits 589127f4ac8b5cf11cf88fb0cd116ffed4d2181e, d869fed663b113b95a74ad53e1b5cae6ab31f29e, and e08f78c656c9394d6737c022bde087e0f33336fd, points to the Rack::Multipart::Parser.handle_fast_forward method as the core of the vulnerability. This function is part of a state machine responsible for finding the initial boundary. Before the fix, it would indefinitely append data to an internal buffer (@sbuf) while searching for the boundary, without any size checks. The patches rectify this by introducing a BOUNDARY_START_LIMIT and raising an error if the buffer size exceeds this limit.

Consequently, two key functions would appear in a runtime profile during an exploit:

Rack::Multipart::Parser.handle_fast_forward: This is the direct location of the vulnerable code. It's where the unbounded memory allocation occurs.
Rack::Multipart.parse_multipart: This is the high-level API function that applications call to parse multipart data. It initiates the parser and would be the entry point of the vulnerable operation in a stack trace.

An engineer with this CVE in their environment should be aware that any endpoint accepting multipart/form-data uploads is a potential vector. Monitoring memory usage on application workers handling these requests would likely show spikes corresponding to exploit attempts. The presence of Rack::Multipart.parse_multipart and Rack::Multipart::Parser.handle_fast_forward in performance profiles or stack traces of memory-intensive requests would be a strong indicator of this vulnerability being triggered.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-61770: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)

Summary

Details

Impact

Mitigation

CVE-2025-61770:

7.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

7.5

7.5

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2025-61770: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)

Summary

Details

Impact

Mitigation

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI