CVE-2025-46727

一、漏洞信息
 漏洞编号：[CVE-2025-46727](https://nvd.nist.gov/vuln/detail/CVE-2025-46727)
 漏洞归属组件：[rubygem-rack](https://gitee.com/src-openeuler/rubygem-rack)
 漏洞归属的版本：2.0.4,2.0.8,2.2.2,2.2.3.1,2.2.4
 CVSS V3.0分值：
  BaseScore：7.5 High
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, `Rack::QueryParser` parses query strings and `application/x-www-form-urlencoded` bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with extremely large numbers of parameters. The vulnerability arises because `Rack::QueryParser` iterates over each `&`-separated key-value pair and adds it to a Hash without enforcing an upper bound on the total number of parameters. This allows an attacker to send a single request containing hundreds of thousands (or more) of parameters, which consumes excessive memory and CPU during parsing. An attacker can trigger denial of service by sending specifically crafted HTTP requests, which can cause memory exhaustion or pin CPU resources, stalling or crashing the Rack server. This results in full service disruption until the affected worker is restarted. Versions 2.2.14, 3.0.16, and 3.1.14 fix the issue. Some other mitigations are available. One may use middleware to enforce a maximum query string size or parameter count, or employ a reverse proxy (such as Nginx) to limit request sizes and reject oversized query strings or bodies. Limiting request body sizes and query string lengths at the web server or CDN level is an effective mitigation.
 漏洞公开时间：2025-05-08 07:15:54
 漏洞创建时间：2025-05-28 15:35:31
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-46727
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| security-advisories.github.com | https://github.com/rack/rack/commit/2bb5263b464b65ba4b648996a579dbd180d2b712 |  |
| security-advisories.github.com | https://github.com/rack/rack/commit/3f5a4249118d09d199fe480466c8c6717e43b6e3 |  |
| security-advisories.github.com | https://github.com/rack/rack/commit/cd6b70a1f2a1016b73dc906f924869f4902c2d74 |  |
| security-advisories.github.com | https://github.com/rack/rack/security/advisories/GHSA-gjh7-p2fx-99vx |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-46727 | https://bugzilla.suse.com/show_bug.cgi?id=1242891 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2025-46727 | https://bugzilla.suse.com/show_bug.cgi?id=1242891 |
| suse_bugzilla | https://github.com/rack/rack/commit/2bb5263b464b65ba4b648996a579dbd180d2b712 | https://bugzilla.suse.com/show_bug.cgi?id=1242891 |
| suse_bugzilla | https://github.com/rack/rack/commit/3f5a4249118d09d199fe480466c8c6717e43b6e3 | https://bugzilla.suse.com/show_bug.cgi?id=1242891 |
| suse_bugzilla | https://github.com/rack/rack/commit/cd6b70a1f2a1016b73dc906f924869f4902c2d74 | https://bugzilla.suse.com/show_bug.cgi?id=1242891 |
| suse_bugzilla | https://github.com/rack/rack/security/advisories/GHSA-gjh7-p2fx-99vx | https://bugzilla.suse.com/show_bug.cgi?id=1242891 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2364966 | https://bugzilla.suse.com/show_bug.cgi?id=1242891 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2025:7604 | https://bugzilla.redhat.com/show_bug.cgi?id=2364966 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2025:7605 | https://bugzilla.redhat.com/show_bug.cgi?id=2364966 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2025:8254 | https://bugzilla.redhat.com/show_bug.cgi?id=2364966 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2025:8256 | https://bugzilla.redhat.com/show_bug.cgi?id=2364966 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2025:8279 | https://bugzilla.redhat.com/show_bug.cgi?id=2364966 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2025:8290 | https://bugzilla.redhat.com/show_bug.cgi?id=2364966 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2025:8291 | https://bugzilla.redhat.com/show_bug.cgi?id=2364966 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2025:8289 | https://bugzilla.redhat.com/show_bug.cgi?id=2364966 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2025:8288 | https://bugzilla.redhat.com/show_bug.cgi?id=2364966 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2025:8319 | https://bugzilla.redhat.com/show_bug.cgi?id=2364966 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2025:8322 | https://bugzilla.redhat.com/show_bug.cgi?id=2364966 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2025:8323 | https://bugzilla.redhat.com/show_bug.cgi?id=2364966 |
| ruby |  | https://github.com/rubysec/ruby-advisory-db/gems/rack/CVE-2025-46727.yml |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2025-46727 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/rack/rack/commit/2bb5263b464b65ba4b648996a579dbd180d2b712 |  | security-advisories.github.com |
|  |  | https://github.com/rack/rack/commit/3f5a4249118d09d199fe480466c8c6717e43b6e3 |  | security-advisories.github.com |
|  |  | https://github.com/rack/rack/commit/cd6b70a1f2a1016b73dc906f924869f4902c2d74 |  | security-advisories.github.com |
|  |  | https://github.com/rack/rack/commit/2bb5263b464b65ba4b648996a579dbd180d2b712 |  | suse_bugzilla |
|  |  | https://github.com/rack/rack/commit/3f5a4249118d09d199fe480466c8c6717e43b6e3 |  | suse_bugzilla |
|  |  | https://github.com/rack/rack/commit/cd6b70a1f2a1016b73dc906f924869f4902c2d74 |  | suse_bugzilla |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  在 2.2.14、3.0.16 和 3.1.14 之前的版本中，Rack::QueryParser 会把查询字符串和 application/x-www-form-urlencoded 请求体解析成 Ruby 数据结构，但并未限制参数数量，攻击者可借此发送包含极大量参数的请求。社区版本均收到影响
 openEuler评分：
  7.5
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(2.2.4):受影响
2.openEuler-20.03-LTS-SP4(2.2.3.1):受影响
3.openEuler-22.03-LTS-SP3(2.2.3.1):受影响
4.openEuler-22.03-LTS-SP4(2.2.3.1):受影响
5.openEuler-24.03-LTS(2.2.4):受影响
6.openEuler-24.03-LTS-Next(2.2.4):受影响
7.openEuler-24.03-LTS-SP1(2.2.4):受影响
8.openEuler-24.03-LTS-SP2(2.2.4):受影响

修复是否涉及abi变化(是/否)：
  1.master(2.2.4):否
2.openEuler-20.03-LTS-SP4(2.2.3.1):否
3.openEuler-22.03-LTS-SP3(2.2.3.1):否
4.openEuler-22.03-LTS-SP4(2.2.3.1):否
5.openEuler-24.03-LTS(2.2.4):否
6.openEuler-24.03-LTS-Next(2.2.4):否
7.openEuler-24.03-LTS-SP1(2.2.4):否
8.openEuler-24.03-LTS-SP2(2.2.4):否

原因说明：
  1.master(2.2.4):正常修复
2.openEuler-20.03-LTS-SP4(2.2.3.1):正常修复
3.openEuler-22.03-LTS-SP3(2.2.3.1):正常修复
4.openEuler-22.03-LTS-SP4(2.2.3.1):正常修复
5.openEuler-24.03-LTS(2.2.4):正常修复
6.openEuler-24.03-LTS-Next(2.2.4):正常修复
7.openEuler-24.03-LTS-SP1(2.2.4):正常修复
8.openEuler-24.03-LTS-SP2(2.2.4):正常修复

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-2291

src-openEuler/rubygem-rack

Content Risk Flag

Comments (4)

src-openEuler/rubygem-rack .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-46727

Comments (4)

Search

src-openEuler/rubygem-rack