CVE-2025-46727

A flaw was found in Rack::QueryParser. This vulnerability allows denial of service via oversized HTTP requests containing many parameters, resulting in memory exhaustion that consumes all available memory or CPU resource pinning, which keeps the CPU constantly busy.

This vulnerability is rated as an IMPORTANT severity because the vulnerabilty was found in the Rack::QueryParser component which arises because Rack::QueryParser parses query strings and application/x-www-form-urlencoded bodies into Ruby data structures without imposing any limit on the number of parameters, when an attacker sends requests with an extremely large number of parameters, Rack::QueryParser consumes excessive memory and CPU during parsing, leading to memory exhaustion, this results in a denial of service, causing the Rack server to crash and leading to full service disruption.

Red Hat Satellite 6.15 includes an affected version of rubygem-rack; however, since it does not utilize Rack::QueryParser, it is not actually vulnerable to the flaw, lowering product-specific impact. The issue has already been addressed in Red Hat Satellite versions 6.16 and 6.17, and updates for other supported versions may follow based on the product lifecycle policy.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This issue can be mitigated without upgrading by preventing oversized requests from reaching Rack. Deploy a reverse proxy (such as Nginx) in front of the application to limit request sizes and reject oversized query strings or bodies, use Rack middleware to enforce a maximum query string size or parameter count, or limit request body sizes and query string lengths at the web server or CDN level. These measures prevent a single request containing an extremely large number of parameters from consuming excessive memory or CPU during query parsing. For a permanent fix, update to a version of Rack that limits the number of parsed parameters (upstream Rack versions 2.2.14, 3.0.16, and 3.1.14 address this issue).