CVE-2025-26803: Phusion Passenger DOS Vulnerability

CVE-2025-26803 Overview

CVE-2025-26803 is a denial of service vulnerability affecting the HTTP parser in Phusion Passenger versions 6.0.21 through 6.0.25. The vulnerability allows attackers to cause service disruption by sending HTTP requests with invalid HTTP methods, triggering improper parsing behavior that leads to application unavailability.

Critical Impact
Remote attackers can exploit this vulnerability without authentication to cause denial of service conditions, potentially affecting all web applications served by vulnerable Phusion Passenger instances.

Affected Products

Phusion Passenger 6.0.21
Phusion Passenger 6.0.22, 6.0.23, 6.0.24
Phusion Passenger 6.0.25

Discovery Timeline

2025-02-24 - CVE-2025-26803 published to NVD
2025-02-28 - Last updated in NVD database

Technical Details for CVE-2025-26803

Vulnerability Analysis

This vulnerability resides in the HTTP header parser component of Phusion Passenger, specifically within the HttpHeaderParser.h file. The flaw is categorized under CWE-908 (Use of Uninitialized Resource), indicating that the parser fails to properly handle certain error states when processing malformed HTTP requests.

When the HTTP parser encounters a request with an invalid HTTP method, the vulnerability manifests due to improper state management in the llhttp parsing logic. The parser's execution flow does not correctly validate the state after resuming from paused states, leading to undefined behavior that can crash the application server.

The vulnerability is network-accessible and requires no privileges or user interaction to exploit, making it particularly dangerous for internet-facing deployments. Successful exploitation results in complete loss of availability for web applications running on the affected Passenger server.

Root Cause

The root cause lies in the http_parser_execute_and_handle_pause function within the HTTP header parser. The original implementation failed to properly check the parser error state after calling llhttp_resume() or llhttp_resume_after_upgrade() before continuing execution. This oversight allowed the parser to continue processing in an invalid state when receiving malformed HTTP methods.

The vulnerable code path handled pause states (HPE_PAUSED, HPE_PAUSED_UPGRADE) but did not re-verify the parser's error status after resumption, leading to the use of uninitialized or corrupted parser state during subsequent operations.

Attack Vector

An attacker can exploit this vulnerability by sending specially crafted HTTP requests with invalid HTTP methods to a web server running vulnerable versions of Phusion Passenger. The attack is:

Network-based: Exploitable remotely over HTTP/HTTPS
No authentication required: Anonymous attackers can trigger the vulnerability
No user interaction needed: Exploitation is fully automated
Low complexity: Simple malformed requests can trigger the condition

// Vulnerable code pattern from HttpHeaderParser.h
static size_t http_parser_execute_and_handle_pause(llhttp_t *parser,
    const char *data, size_t len, bool &paused)
{
    llhttp_errno_t rc = llhttp_get_errno(parser);
    switch (rc) {
    case HPE_PAUSED_UPGRADE:
        llhttp_resume_after_upgrade(parser);
        // Missing: rc = llhttp_get_errno(parser);
        goto happy_path;
    case HPE_PAUSED:
        llhttp_resume(parser);
        // Missing: rc = llhttp_get_errno(parser);
        goto happy_path;
    // ...

Source: GitHub Commit

Detection Methods for CVE-2025-26803

Indicators of Compromise

Unexpected Passenger process crashes or restarts in application logs
HTTP access logs showing requests with unusual or malformed HTTP methods
Increased frequency of 5xx errors returned to clients
System monitoring alerts for Passenger worker process terminations

Detection Strategies

Monitor web server access logs for HTTP requests with non-standard methods (anything other than GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS, CONNECT, TRACE)
Implement network intrusion detection rules to flag malformed HTTP method requests
Set up application performance monitoring to detect sudden service unavailability patterns
Review Passenger error logs for parser-related exceptions or crash dumps

Monitoring Recommendations

Configure alerting for Passenger process restart frequency exceeding normal thresholds
Deploy web application firewalls (WAF) with rules to validate HTTP method conformance
Enable verbose logging on Passenger instances to capture detailed request parsing information
Monitor system resource utilization for abnormal patterns indicating DoS conditions

How to Mitigate CVE-2025-26803

Immediate Actions Required

Upgrade Phusion Passenger to version 6.0.26 or later immediately
Review web server access logs for any exploitation attempts prior to patching
Consider implementing a WAF rule to reject requests with invalid HTTP methods as a temporary measure
Restart all Passenger instances after upgrading to ensure the patched version is active

Patch Information

Phusion has released version 6.0.26 which addresses this vulnerability. The fix properly validates the parser state after resuming from paused conditions by adding error state checks following llhttp_resume() and llhttp_resume_after_upgrade() calls.

The patched code now includes:

// Fixed code pattern from HttpHeaderParser.h
static size_t http_parser_execute_and_handle_pause(llhttp_t *parser,
    const char *data, size_t len)
{
    llhttp_errno_t rc = llhttp_get_errno(parser);
    switch (rc) {
    case HPE_PAUSED_UPGRADE:
        llhttp_resume_after_upgrade(parser);
        rc = llhttp_get_errno(parser);  // Added state verification
        goto happy_path;
    case HPE_PAUSED:
        llhttp_resume(parser);
        rc = llhttp_get_errno(parser);  // Added state verification
        goto happy_path;
    // ...