CVE-2025-61771

A flaw was found in Rack where Rack::Multipart::Parser stores non-file form fields entirely in memory without size limits. An attacker can send a multipart/form-data request with an extremely large text field, causing the server to allocate large amounts of memory which leads to a denial of service crash due to out-of-memory issue.

The impact is IMPORTANT because this happens over a network and causes a denial of service. Large non-file fields are buffered in memory instead of being streamed or capped, leading to memory exhaustion and worker crashes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.