Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, `Rack::Request#POST` reads the entire request body into memory for `Content-Type: application/x-www-form-urlencoded`, calling `rack.input.read(nil)` without enforcing a length or cap. Large request bodies can therefore be buffered completely into process memory before parsing, leading to denial of service (DoS) through memory exhaustion. Users should upgrade to Rack version 2.2.20, 3.1.18, or 3.2.3, anu of which enforces form parameter limits using `query_parser.bytesize_limit`, preventing unbounded reads of `application/x-www-form-urlencoded` bodies. Additionally, enforce strict maximum body size at the proxy or web server layer (e.g., Nginx `client_max_body_size`, Apache `LimitRequestBody`).

redhat RHSA-2025:19512: RHSA-2025:19512: pcs security update (Important)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-a35addbf9b advisory.

    Update to Rack 2.2.21



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-b6e0f437b6 advisory.

    Update to Rack 3.1.19

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-eae2126736 advisory.

    Update to Rack 2.2.21

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:21036 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-     separated parameters (CVE-2025-59830)

    * rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)

    * rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory     exhaustion) (CVE-2025-61771)

    * rack: Rack memory exhaustion denial of service (CVE-2025-61772)

    * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion     (CVE-2025-61919)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:20962 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-     separated parameters (CVE-2025-59830)

    * rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)

    * rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory     exhaustion) (CVE-2025-61771)

    * rack: Rack memory exhaustion denial of service (CVE-2025-61772)

    * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion     (CVE-2025-61919)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:19512 advisory.

    * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-     separated parameters (CVE-2025-59830)

    * rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)

    * rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory     exhaustion) (CVE-2025-61771)

    * rack: Rack memory exhaustion denial of service (CVE-2025-61772)

    * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion     (CVE-2025-61919)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19832 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion     (CVE-2025-61919)

    * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-     separated parameters (CVE-2025-59830)

    * foreman: OS command injection via ct_location and fcct_location parameters (CVE-2025-10622)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19856 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-     separated parameters (CVE-2025-59830)

    * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion     (CVE-2025-61919)

    * foreman: OS command injection via ct_location and fcct_location parameters (CVE-2025-10622)

    Users of Red Hat Satellite are advised to upgrade to these updated     packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19855 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * Host registration shows no errors even when built submission fails at the end of Global Registration     process

    * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion     (CVE-2025-61919)

    * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-     separated parameters (CVE-2025-59830)

    * foreman: OS command injection via ct_location and fcct_location parameters (CVE-2025-10622)

    Users of Red Hat Satellite are advised to upgrade to these updated     packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19948 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-     separated parameters (CVE-2025-59830)

    * rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)

    * rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory     exhaustion) (CVE-2025-61771)

    * rack: Rack memory exhaustion denial of service (CVE-2025-61772)

    * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion     (CVE-2025-61919)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-19513 advisory.

    [0.12.0-3.0.1.el10_0.3]
    - Fixed CVE-2025-59830, CVE-2025-61770, CVE-2025-61771, CVE-2025-61772, CVE-2025-61919 by updating bundled     rubygem rack       Resolves: RHEL-120943, RHEL-121036, RHEL-123631, RHEL-123644, RHEL-124942

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-19719 advisory.

    [0.10.18-2.0.1.7]
    - Replaced HAM-logo

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19800 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-     separated parameters (CVE-2025-59830)

    * rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)

    * rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory     exhaustion) (CVE-2025-61771)

    * rack: Rack memory exhaustion denial of service (CVE-2025-61772)

    * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion     (CVE-2025-61919)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:19719 advisory.

    * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-     separated parameters (CVE-2025-59830)

    * rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)

    * rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory     exhaustion) (CVE-2025-61771)

    * rack: Rack memory exhaustion denial of service (CVE-2025-61772)

    * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion     (CVE-2025-61919)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19733 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-     separated parameters (CVE-2025-59830)

    * rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)

    * rack: Rack memory exhaustion denial of service (CVE-2025-61772)

    * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion     (CVE-2025-61919)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19734 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-     separated parameters (CVE-2025-59830)

    * rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)

    * rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory     exhaustion) (CVE-2025-61771)

    * rack: Rack memory exhaustion denial of service (CVE-2025-61772)

    * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion     (CVE-2025-61919)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19736 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-     separated parameters (CVE-2025-59830)

    * rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)

    * rack: Rack memory exhaustion denial of service (CVE-2025-61772)

    * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion     (CVE-2025-61919)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19719 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-     separated parameters (CVE-2025-59830)

    * rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)

    * rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory     exhaustion) (CVE-2025-61771)

    * rack: Rack memory exhaustion denial of service (CVE-2025-61772)

    * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion     (CVE-2025-61919)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-19512 advisory.

    [0.11.9-2.el9_6.2]
    - Fixed CVE-2025-59830, CVE-2025-61770, CVE-2025-61771, CVE-2025-61772, CVE-2025-61919 by updating bundled     rubygem rack       Resolves: RHEL-120943, RHEL-121036, RHEL-123631, RHEL-123644, RHEL-124942

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19647 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-     separated parameters (CVE-2025-59830)

    * rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)

    * rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory     exhaustion) (CVE-2025-61771)

    * rack: Rack memory exhaustion denial of service (CVE-2025-61772)

    * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion     (CVE-2025-61919)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:19513 advisory.

    The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.

    Security Fix(es):

    * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-     separated parameters (CVE-2025-59830)

    * rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)

    * rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory     exhaustion) (CVE-2025-61771)

    * rack: Rack memory exhaustion denial of service (CVE-2025-61772)

    * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion     (CVE-2025-61919)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6048 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6048-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     November 03, 2025                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : ruby-rack     CVE ID         : CVE-2025-61770 CVE-2025-61771 CVE-2025-61772                      CVE-2025-61780 CVE-2025-61919

    Multiple security issues were found in Rack, an interface for developing     web applications in Ruby, which could result in denial of service or     proxy bypass.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 2.2.20-0+deb12u1.

    For the stable distribution (trixie), these problems have been fixed in     version 3.1.18-1~deb13u1.

    We recommend that you upgrade your ruby-rack packages.

    For the detailed security status of ruby-rack please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ruby-rack

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4357 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-4357-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     November 01, 2025                           https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : ruby-rack     Version        : 2.1.4-3+deb11u4     CVE ID         : CVE-2025-32441 CVE-2025-46727 CVE-2025-59830                      CVE-2025-61770 CVE-2025-61771 CVE-2025-61772                      CVE-2025-61780 CVE-2025-61919     Debian Bug     : 1104927 1116431 1117855 1117856 1117627 1117628

    Multiple vulnerabilities were found in ruby-rack, a modular Ruby     webserver interface, as follows:

      - CVE-2025-32441: Rack session can be restored after deletion.
      - CVE-2025-46727: Unbounded parameter parsing in Rack::QueryParser         can lead to memory exhaustion.
      - CVE-2025-59830: Unbounded parameter parsing in Rack::QueryParser         can lead to memory exhaustion via semicolon-separated parameters.
      - CVE-2025-61770: Unbounded multipart preamble buffering enables         DoS (memory exhaustion).
      - CVE-2025-61771: Multipart parser buffers large nonfile fields         entirely in memory, enabling DoS (memory exhaustion).
      - CVE-2025-61772: Multipart parser buffers unbounded per-part         headers, enabling DoS (memory exhaustion).
      - CVE-2025-61919: Unbounded read in Rack::Request form parsing can         lead to memory exhaustion.
      - CVE-2025-61780: Improper handling of headers in Rack::Sendfile         may allow proxy bypass.

    For Debian 11 bullseye, these problems have been fixed in version     2.1.4-3+deb11u4.

    We recommend that you upgrade your ruby-rack packages.

    For the detailed security status of ruby-rack please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ruby-rack

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the RACK Ruby library installed on the remote host is prior to 2.2.20 / 3.1.18 / 3.2.3. It is, therefore, affected by the following vulnerabilities:

  - Rack::Request#POST reads the entire request body into memory for Content-Type: application/x-www-form-urlencoded, calling     rack.input.read(nil) without enforcing a length or cap. Large request bodies can therefore be buffered completely into process     memory before parsing, leading to denial of service (DoS) through memory exhaustion. (CVE-2025-61919)

  - A possible information disclosure vulnerability existed in Rack::Sendfile when running behind a proxy that     supports x-sendfile headers (such as Nginx). Specially crafted headers could cause Rack::Sendfile to miscommunicate     with the proxy and trigger unintended internal requests, potentially bypassing proxy-level access restrictions. (CVE-2025-61780)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3,     `Rack::Request#POST` reads the entire request body into memory for `Content-Type: application/x-www-form-     urlencoded`, calling `rack.input.read(nil)` without enforcing a length or cap. Large request bodies can     therefore be buffered completely into process memory before parsing, leading to denial of service (DoS)     through memory exhaustion. Users should upgrade to Rack version 2.2.20, 3.1.18, or 3.2.3, anu of which     enforces form parameter limits using `query_parser.bytesize_limit`, preventing unbounded reads of     `application/x-www-form-urlencoded` bodies. Additionally, enforce strict maximum body size at the proxy or     web server layer (e.g., Nginx `client_max_body_size`, Apache `LimitRequestBody`). (CVE-2025-61919)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
275257	Fedora 41 : rubygem-rack (2025-a35addbf9b)	Nessus	Fedora Local Security Checks	high
275256	Fedora 43 : rubygem-rack (2025-b6e0f437b6)	Nessus	Fedora Local Security Checks	medium
275253	Fedora 42 : rubygem-rack (2025-eae2126736)	Nessus	Fedora Local Security Checks	high
274826	RHEL 10 : pcs (RHSA-2025:21036)	Nessus	Red Hat Local Security Checks	high
274804	RHEL 9 : pcs (RHSA-2025:20962)	Nessus	Red Hat Local Security Checks	high
274603	RockyLinux 9 : pcs (RLSA-2025:19512)	Nessus	Rocky Linux Local Security Checks	high
274589	RHEL 9 : Satellite 6.17.6 Async Update (Important) (RHSA-2025:19832)	Nessus	Red Hat Local Security Checks	high
274588	RHEL 8 : Satellite 6.15.5.6 Async Update (Important) (RHSA-2025:19856)	Nessus	Red Hat Local Security Checks	high
274586	RHEL 8 / 9 : Satellite 6.16.5.5 Async Update (Important) (RHSA-2025:19855)	Nessus	Red Hat Local Security Checks	high
274569	RHEL 8 : pcs (RHSA-2025:19948)	Nessus	Red Hat Local Security Checks	high
274515	Oracle Linux 10 : pcs (ELSA-2025-19513)	Nessus	Oracle Linux Local Security Checks	high
274390	Oracle Linux 8 : pcs (ELSA-2025-19719)	Nessus	Oracle Linux Local Security Checks	high
274066	RHEL 9 : pcs (RHSA-2025:19800)	Nessus	Red Hat Local Security Checks	high
272306	RockyLinux 8 : pcs (RLSA-2025:19719)	Nessus	Rocky Linux Local Security Checks	high
272295	RHEL 9 : pcs (RHSA-2025:19733)	Nessus	Red Hat Local Security Checks	high
272292	RHEL 8 : pcs (RHSA-2025:19734)	Nessus	Red Hat Local Security Checks	high
272285	RHEL 9 : pcs (RHSA-2025:19736)	Nessus	Red Hat Local Security Checks	high
272279	RHEL 8 : pcs (RHSA-2025:19719)	Nessus	Red Hat Local Security Checks	high
272267	Oracle Linux 9 : pcs (ELSA-2025-19512)	Nessus	Oracle Linux Local Security Checks	high
272260	RHEL 8 : pcs (RHSA-2025:19647)	Nessus	Red Hat Local Security Checks	high
272234	RHEL 10 : pcs (RHSA-2025:19513)	Nessus	Red Hat Local Security Checks	high
272224	Debian dsa-6048 : ruby-rack - security update	Nessus	Debian Local Security Checks	medium
272174	Debian dla-4357 : ruby-rack - security update	Nessus	Debian Local Security Checks	medium
270698	Ruby RACK < 2.2.20 / 3.x < 3.1.18 / 3.2 < 3.2.3 Multiple Vulnerabilities	Nessus	Misc.	high
270278	Linux Distros Unpatched Vulnerability : CVE-2025-61919	Nessus	Misc.	high

Detections

Analytics

CVE-2025-61919

high

Tenable Plugins

Coming Soon

high

medium

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

medium

high

high