CVE-2025-59830: Rack QueryParser DoS Vulnerability

CVE-2025-59830 Overview

CVE-2025-59830 is a Denial of Service vulnerability in Rack, the modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers can use ; separators to bypass the parameter count limit and submit more parameters than intended, leading to increased CPU and memory consumption.

Critical Impact

Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to resource exhaustion attacks, enabling denial-of-service conditions against affected Ruby web applications.

Affected Products

• Rack versions prior to 2.2.18
• Ruby web applications using Rack::QueryParser with default configuration
• Middleware components that invoke query parsing without explicit delimiter configuration

Discovery Timeline

• 2025-09-25 - CVE-2025-59830 published to NVD
• 2025-10-10 - Last updated in NVD database

Technical Details for CVE-2025-59830

Vulnerability Analysis

This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption). The flaw exists in how Rack::QueryParser handles parameter delimiters when enforcing its parameter count limit. The parser is designed to protect against resource exhaustion by limiting the number of parameters it will process, but this protection mechanism can be circumvented.

When processing query strings, Rack::QueryParser splits parameters using both & and ; as delimiters, which is compliant with HTML specifications that allow both characters as parameter separators. However, the params_limit enforcement mechanism only counts parameters separated by &, creating an inconsistency that attackers can exploit.

By crafting malicious query strings that use ; as the delimiter instead of &, an attacker can submit significantly more parameters than the configured limit allows. This bypass enables resource exhaustion attacks that can consume excessive CPU and memory on the target server.

Root Cause

The root cause is an inconsistency between the delimiter recognition logic (which accepts both & and ;) and the parameter counting logic (which only counts & separators). This design flaw allows the security control to be bypassed when ; is used as the parameter separator.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending HTTP requests with query strings containing a large number of parameters separated by ; characters instead of &. Since the parameter limit only applies to &-separated values, the parser will accept and process an arbitrarily large number of ;-separated parameters.

The attack is relatively straightforward: craft a URL or POST body with numerous parameters using ; delimiters. For example, a query string like a=1;b=2;c=3;...;z=26 with thousands of parameters would bypass the limit check, forcing the server to allocate memory and CPU cycles for each parameter.

For detailed technical information about this vulnerability, see the GitHub Security Advisory.

Detection Methods for CVE-2025-59830

Indicators of Compromise

• Unusually large query strings in HTTP requests containing numerous ; separators
• Elevated memory consumption on Ruby web application servers
• Increased CPU utilization during request processing without corresponding traffic increases
• Slow response times or timeouts on Rack-based applications

Detection Strategies

• Monitor web server logs for HTTP requests with abnormally long query strings containing multiple ; characters
• Implement request size limits at the load balancer or reverse proxy layer
• Configure application performance monitoring (APM) tools to alert on unusual memory allocation patterns
• Use SentinelOne's Singularity platform to detect anomalous resource consumption patterns indicative of DoS attacks

Monitoring Recommendations

• Set up alerts for sustained high CPU or memory usage on Ruby application servers
• Monitor request latency metrics for degradation patterns consistent with resource exhaustion
• Track query string lengths and parameter counts at the web application firewall (WAF) level
• Implement rate limiting to reduce the impact of sustained attack attempts

How to Mitigate CVE-2025-59830

Immediate Actions Required

• Upgrade Rack to version 2.2.18 or later immediately
• Review application code for direct invocations of Rack::QueryParser and ensure explicit delimiter configuration
• Implement request size limits at the reverse proxy or load balancer level as a defense-in-depth measure
• Consider rate limiting for endpoints that accept user-supplied query parameters

Patch Information

This vulnerability has been patched in Rack version 2.2.18. The fix ensures that the parameter limit is enforced consistently regardless of which delimiter character is used. Organizations should update their Gemfile to require the patched version and run bundle update rack to apply the fix.

The security patch is available in commit 54e4ffdd5affebcb0c015cc6ae74635c0831ed71.

Workarounds

• Configure Rack::QueryParser with an explicit & delimiter to disable ; splitting
• Implement request filtering at the WAF or reverse proxy to reject requests with excessive ; characters in query strings
• Apply resource limits (memory, CPU) to Ruby application processes using containerization or cgroups
• Deploy request size limits to prevent oversized query strings from reaching the application

# Gemfile update example
# Ensure Rack is updated to the patched version
gem 'rack', '>= 2.2.18'

# Then run:
# bundle update rack