CVE-2025-61921

A flaw was found in Sinatra. A Regular Expression Denial of Service (ReDoS) vulnerability can be triggered when parsing the If-Match and If-None-Match HTTP headers. A remote attacker can exploit this issue by sending a specially crafted header to an application endpoint that uses the etag method, causing a excessive CPU consumption and potentially resulting in a denial of service.

This flaw can only be exploited in applications using the etag method to generate a response and if they are using Ruby below version 3.2, limiting the exposure of this issue.

The most likely security impact of this vulnerability is an unexpected amount of time to parse the If-Match and If-None-Match HTTP headers, potentially resulting in a degraded application performance but not completely deny service to legitimate users. Due to this reason, this flaw has been rated with a moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.