https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 18:51:18 +0000 https://vulnerability.circl.lu/vuln/brew-mailcatcher-cve-2025-59830 <p><strong>Affected:</strong> Homebrew: mailcatcher</p> <p>## Summary</p> <p>`Rack::QueryParser` in version `&lt; 2.2.18` enforces its `params_limit` only for parameters separated by `&amp;`, while still splitting on both `&amp;` and `;`. As a result, attackers could use `;` separators to bypass the parameter count limit and submit more parameters than intended.</p> <p>## Details</p> <p>The issue arises because `Rack::QueryParser#check_query_string` counts only `&amp;` characters when determining the number of parameters, but the default separator regex `DEFAULT_SEP = /[&amp;;] */n` splits on both `&amp;` and `;`. This mismatch means that queries using `;` separators were not included in the parameter count, allowing `params_limit` to be bypassed.</p> <p>Other safeguards (`bytesize_limit` and `key_space_limit`) still applied, but did not prevent this particular bypass.</p> <p>## Impact</p> <p>Applications or middleware that directly invoke `Rack::QueryParser` with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector.</p> <p>`Rack::Request`, the primary entry point for typical Rack applications, uses `QueryParser` in a safe way and does not appear vulnerable by default. As such, the severity is considered **low**, with the impact limited to edge cases where `QueryParser` is used directly.</p> <p>## Mitigation</p> <p>* Upgrade to a patched version of Rack where both `&amp;` and `;` are counted consistently toward `params_limit`. * If upgrading is not immediately possible, configure `QueryParser` with an…</p> <p><strong>Affected:</strong> Homebrew: mailcatcher</p> <p>## Summary</p> <p>`Rack::QueryParser` in version `&lt; 2.2.18` enforces its `params_limit` only for parameters separated by `&amp;`, while still splitting on both `&amp;` and `;`. As a result, attackers could use `;` separators to bypass the parameter count limit and submit more parameters than intended.</p> <p>## Details</p> <p>The issue arises because `Rack::QueryParser#check_query_string` counts only `&amp;` characters when determining the number of parameters, but the default separator regex `DEFAULT_SEP = /[&amp;;] */n` splits on both `&amp;` and `;`. This mismatch means that queries using `;` separators were not included in the parameter count, allowing `params_limit` to be bypassed.</p> <p>Other safeguards (`bytesize_limit` and `key_space_limit`) still applied, but did not prevent this particular bypass.</p> <p>## Impact</p> <p>Applications or middleware that directly invoke `Rack::QueryParser` with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector.</p> <p>`Rack::Request`, the primary entry point for typical Rack applications, uses `QueryParser` in a safe way and does not appear vulnerable by default. As such, the severity is considered **low**, with the impact limited to edge cases where `QueryParser` is used directly.</p> <p>## Mitigation</p> <p>* Upgrade to a patched version of Rack where both `&amp;` and `;` are counted consistently toward `params_limit`. * If upgrading is not immediately possible, configure `QueryParser` with an…</p> https://vulnerability.circl.lu/vuln/brew-mailcatcher-cve-2025-59830 https://vulnerability.circl.lu/vuln/cve-2025-59830 <p><strong>Affected:</strong> rack</p> <p>Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &amp;, while still splitting on both &amp; and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18.</p> <p><strong>Affected:</strong> rack</p> <p>Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &amp;, while still splitting on both &amp; and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18.</p> https://vulnerability.circl.lu/vuln/cve-2025-59830