Allocation of Resources Without Limits or Throttling

🗓️ 07 May 2025 23:42:56Reported by Snyk Security DatabaseType

Rack vulnerability causes resource exhaustion from excessive query parameters; upgrade to Rack 2.2.14, 3.0.16, or 3.1.14.

Reporter	Title	Published	Views	Family All 174
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	25 Jun 202513:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Aspera Faspex is affected by open-source related vulnerabilities and unauthorized actions from authenticated users	29 Jul 202522:45	–	ibm
Tenable Nessus	Amazon Linux 2 : pcs (ALAS-2025-2856)	29 May 202500:00	–	nessus
Tenable Nessus	Debian dla-4357 : ruby-rack - security update	2 Nov 202500:00	–	nessus
Tenable Nessus	Fedora 43 : rubygem-actioncable / rubygem-actionmailbox / rubygem-actionmailer / etc (2025-203b7db566)	16 Jul 202500:00	–	nessus
Tenable Nessus	Fedora 41 : rubygem-rack (2025-a35addbf9b)	12 Nov 202500:00	–	nessus
Tenable Nessus	Fedora 42 : rubygem-rack (2025-eae2126736)	12 Nov 202500:00	–	nessus
Tenable Nessus	MiracleLinux 8 : pcs-0.10.18-2.el8_10.5.ML.1 (AXSA:2025-10529:04)	13 Jan 202600:00	–	nessus
Tenable Nessus	MiracleLinux 9 : pcs-0.11.9-2.el9_6.1.ML.1 (AXSA:2025-10558:05)	13 Jan 202600:00	–	nessus
Tenable Nessus	Oracle Linux 8 : pcs (ELSA-2025-8254)	29 May 202500:00	–	nessus

Vulners

Node

rack_project rackRange3.0.0.beta1–3.0.16

rack_project rackRange3.1.0–3.1.14

Source	Link
security	www.security.snyk.io/vuln/SNYK-RUBY-RACK-10074187
cwe	www.cwe.mitre.org/data/definitions/CWE-770.html

18 Jun 2025 01:13Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.17.5

CVSS 48.7

EPSS0.00911

SSVC