Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0,     there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component     of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause     `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly     resulting in a denial of service attack vector. This header is typically involved in generating the `ETag`     header value. Any applications that use the `etag` method when generating a response are impacted. Version     4.2.0 fixes the issue. (CVE-2025-61921)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0,
    there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component
    of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause
    `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly
    resulting in a denial of service attack vector. This header is typically involved in generating the `ETag`
    header value. Any applications that use the `etag` method when generating a response are impacted. Version
    4.2.0 fixes the issue. (CVE-2025-61921)

ID	Name	Product	Family	Type	Severity
270281	Linux Distros Unpatched Vulnerability : CVE-2025-61921	Nessus	Misc.	Local	medium
435581	SCA: security update for sinatra (GHSA-mr3q-g2mv-mr4q)	Tenable Cloud Security	SCA Checks	Local	medium
435581	SCA: security update for sinatra (GHSA-mr3q-g2mv-mr4q)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2025-61921

medium

Tenable Plugins

medium

medium

medium