Critical Vulnerabilities in ruby-rack: Exposing Sensitive Information and Denial of Service Risks
Summary
USN-7507-1: ruby-rack vulnerabilities. Affects ruby-rack versions < 1.5.2-3+deb8u3ubuntu1~esm10. Fixed in 1.5.2-3+deb8u3ubuntu1~esm10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ruby-rack is a widely used web application framework for Ruby, providing essential tools for building web applications. It facilitates the handling of HTTP requests and responses, session management, and routing. However, recent vulnerabilities have been identified that compromise its security, particularly in versions available for various Ubuntu LTS distributions.
Vulnerability Detail
Two significant vulnerabilities have been discovered in ruby-rack. The first, identified as CVE-2025-32441, allows attackers to exploit improperly handled deleted rack sessions, potentially exposing sensitive information or unauthorized access to user accounts. The second vulnerability, CVE-2025-46727, pertains to an incorrect limitation on the number of parameters in web requests, which could lead to denial of service attacks. This issue specifically affects Ubuntu 20.04 LTS, 22.04 LTS, 24.04 LTS, 24.10, and 25.04.
How To Fix
Minimum fixed version
1.5.2-3+deb8u3ubuntu1~esm10
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ruby-rackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the number of parameters in web requests manually or implement additional validation checks to mitigate the risk of denial of service attacks until the package is updated.
Conclusion
The vulnerabilities in ruby-rack pose significant risks, including unauthorized access and denial of service. It is crucial for users to update their packages to the latest patched versions to mitigate these risks effectively.
See every vulnerability recorded for ruby-rack →
FAQ
ruby-rack is a framework for building web applications in Ruby, providing essential tools for handling HTTP requests and managing sessions.
The vulnerabilities include improper handling of deleted sessions (CVE-2025-32441) and incorrect parameter limitations leading to denial of service (CVE-2025-46727).
The vulnerabilities affect Ubuntu 20.04 LTS, 22.04 LTS, 24.04 LTS, 24.10, and 25.04.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
Implement temporary workarounds such as limiting the number of parameters in requests or adding validation checks until you can update to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby-rack.
