rhsa-2025:19719
Vulnerability from csaf_redhat
Published
2025-11-04 17:06
Modified
2025-11-05 19:37
Summary
Red Hat Security Advisory: pcs security update

Notes

Topic
An update for pcs is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fix(es): * rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830) * rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770) * rack: Rack's multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771) * rack: Rack memory exhaustion denial of service (CVE-2025-61772) * rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion (CVE-2025-61919) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for pcs is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities.\n\nSecurity Fix(es):\n\n* rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters (CVE-2025-59830)\n\n* rack: Rack\u0027s unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)\n\n* rack: Rack\u0027s multipart parser buffers large non?file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)\n\n* rack: Rack memory exhaustion denial of service (CVE-2025-61772)\n\n* rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion (CVE-2025-61919)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:19719",
        "url": "https://access.redhat.com/errata/RHSA-2025:19719"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2398167",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2398167"
      },
      {
        "category": "external",
        "summary": "2402174",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402174"
      },
      {
        "category": "external",
        "summary": "2402175",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402175"
      },
      {
        "category": "external",
        "summary": "2402200",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402200"
      },
      {
        "category": "external",
        "summary": "2403180",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2403180"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_19719.json"
      }
    ],
    "title": "Red Hat Security Advisory: pcs security update",
    "tracking": {
      "current_release_date": "2025-11-05T19:37:17+00:00",
      "generator": {
        "date": "2025-11-05T19:37:17+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.10"
        }
      },
      "id": "RHSA-2025:19719",
      "initial_release_date": "2025-11-04T17:06:17+00:00",
      "revision_history": [
        {
          "date": "2025-11-04T17:06:17+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-11-04T17:06:17+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-11-05T19:37:17+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux HighAvailability (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux HighAvailability (v. 8)",
                  "product_id": "HighAvailability-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::highavailability"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux ResilientStorage (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux ResilientStorage (v. 8)",
                  "product_id": "ResilientStorage-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::resilientstorage"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "pcs-0:0.10.18-2.el8_10.7.src",
                "product": {
                  "name": "pcs-0:0.10.18-2.el8_10.7.src",
                  "product_id": "pcs-0:0.10.18-2.el8_10.7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pcs@0.10.18-2.el8_10.7?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "pcs-0:0.10.18-2.el8_10.7.aarch64",
                "product": {
                  "name": "pcs-0:0.10.18-2.el8_10.7.aarch64",
                  "product_id": "pcs-0:0.10.18-2.el8_10.7.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pcs@0.10.18-2.el8_10.7?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
                "product": {
                  "name": "pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
                  "product_id": "pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pcs-snmp@0.10.18-2.el8_10.7?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "pcs-0:0.10.18-2.el8_10.7.ppc64le",
                "product": {
                  "name": "pcs-0:0.10.18-2.el8_10.7.ppc64le",
                  "product_id": "pcs-0:0.10.18-2.el8_10.7.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pcs@0.10.18-2.el8_10.7?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
                "product": {
                  "name": "pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
                  "product_id": "pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pcs-snmp@0.10.18-2.el8_10.7?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "pcs-0:0.10.18-2.el8_10.7.x86_64",
                "product": {
                  "name": "pcs-0:0.10.18-2.el8_10.7.x86_64",
                  "product_id": "pcs-0:0.10.18-2.el8_10.7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pcs@0.10.18-2.el8_10.7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
                "product": {
                  "name": "pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
                  "product_id": "pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pcs-snmp@0.10.18-2.el8_10.7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "pcs-0:0.10.18-2.el8_10.7.s390x",
                "product": {
                  "name": "pcs-0:0.10.18-2.el8_10.7.s390x",
                  "product_id": "pcs-0:0.10.18-2.el8_10.7.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pcs@0.10.18-2.el8_10.7?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
                "product": {
                  "name": "pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
                  "product_id": "pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/pcs-snmp@0.10.18-2.el8_10.7?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-0:0.10.18-2.el8_10.7.aarch64 as a component of Red Hat Enterprise Linux HighAvailability (v. 8)",
          "product_id": "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64"
        },
        "product_reference": "pcs-0:0.10.18-2.el8_10.7.aarch64",
        "relates_to_product_reference": "HighAvailability-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-0:0.10.18-2.el8_10.7.ppc64le as a component of Red Hat Enterprise Linux HighAvailability (v. 8)",
          "product_id": "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le"
        },
        "product_reference": "pcs-0:0.10.18-2.el8_10.7.ppc64le",
        "relates_to_product_reference": "HighAvailability-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-0:0.10.18-2.el8_10.7.s390x as a component of Red Hat Enterprise Linux HighAvailability (v. 8)",
          "product_id": "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x"
        },
        "product_reference": "pcs-0:0.10.18-2.el8_10.7.s390x",
        "relates_to_product_reference": "HighAvailability-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-0:0.10.18-2.el8_10.7.src as a component of Red Hat Enterprise Linux HighAvailability (v. 8)",
          "product_id": "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src"
        },
        "product_reference": "pcs-0:0.10.18-2.el8_10.7.src",
        "relates_to_product_reference": "HighAvailability-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-0:0.10.18-2.el8_10.7.x86_64 as a component of Red Hat Enterprise Linux HighAvailability (v. 8)",
          "product_id": "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64"
        },
        "product_reference": "pcs-0:0.10.18-2.el8_10.7.x86_64",
        "relates_to_product_reference": "HighAvailability-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-snmp-0:0.10.18-2.el8_10.7.aarch64 as a component of Red Hat Enterprise Linux HighAvailability (v. 8)",
          "product_id": "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64"
        },
        "product_reference": "pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
        "relates_to_product_reference": "HighAvailability-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le as a component of Red Hat Enterprise Linux HighAvailability (v. 8)",
          "product_id": "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le"
        },
        "product_reference": "pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
        "relates_to_product_reference": "HighAvailability-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-snmp-0:0.10.18-2.el8_10.7.s390x as a component of Red Hat Enterprise Linux HighAvailability (v. 8)",
          "product_id": "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x"
        },
        "product_reference": "pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
        "relates_to_product_reference": "HighAvailability-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-snmp-0:0.10.18-2.el8_10.7.x86_64 as a component of Red Hat Enterprise Linux HighAvailability (v. 8)",
          "product_id": "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64"
        },
        "product_reference": "pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
        "relates_to_product_reference": "HighAvailability-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-0:0.10.18-2.el8_10.7.aarch64 as a component of Red Hat Enterprise Linux ResilientStorage (v. 8)",
          "product_id": "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64"
        },
        "product_reference": "pcs-0:0.10.18-2.el8_10.7.aarch64",
        "relates_to_product_reference": "ResilientStorage-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-0:0.10.18-2.el8_10.7.ppc64le as a component of Red Hat Enterprise Linux ResilientStorage (v. 8)",
          "product_id": "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le"
        },
        "product_reference": "pcs-0:0.10.18-2.el8_10.7.ppc64le",
        "relates_to_product_reference": "ResilientStorage-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-0:0.10.18-2.el8_10.7.s390x as a component of Red Hat Enterprise Linux ResilientStorage (v. 8)",
          "product_id": "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x"
        },
        "product_reference": "pcs-0:0.10.18-2.el8_10.7.s390x",
        "relates_to_product_reference": "ResilientStorage-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-0:0.10.18-2.el8_10.7.src as a component of Red Hat Enterprise Linux ResilientStorage (v. 8)",
          "product_id": "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src"
        },
        "product_reference": "pcs-0:0.10.18-2.el8_10.7.src",
        "relates_to_product_reference": "ResilientStorage-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-0:0.10.18-2.el8_10.7.x86_64 as a component of Red Hat Enterprise Linux ResilientStorage (v. 8)",
          "product_id": "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64"
        },
        "product_reference": "pcs-0:0.10.18-2.el8_10.7.x86_64",
        "relates_to_product_reference": "ResilientStorage-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-snmp-0:0.10.18-2.el8_10.7.aarch64 as a component of Red Hat Enterprise Linux ResilientStorage (v. 8)",
          "product_id": "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64"
        },
        "product_reference": "pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
        "relates_to_product_reference": "ResilientStorage-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le as a component of Red Hat Enterprise Linux ResilientStorage (v. 8)",
          "product_id": "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le"
        },
        "product_reference": "pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
        "relates_to_product_reference": "ResilientStorage-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-snmp-0:0.10.18-2.el8_10.7.s390x as a component of Red Hat Enterprise Linux ResilientStorage (v. 8)",
          "product_id": "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x"
        },
        "product_reference": "pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
        "relates_to_product_reference": "ResilientStorage-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-snmp-0:0.10.18-2.el8_10.7.x86_64 as a component of Red Hat Enterprise Linux ResilientStorage (v. 8)",
          "product_id": "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64"
        },
        "product_reference": "pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
        "relates_to_product_reference": "ResilientStorage-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-59830",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-09-25T15:01:07.627558+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2398167"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An unsafe default behavior in Rack::QueryParser allows bypass of the params_limit parameter count restriction when query string parameters are delimited by semicolons (;) rather than ampersands (\u0026). The parser counts only \u0026 when enforcing the limit, while still splitting on both \u0026 and ;. As a result, an attacker can supply a crafted HTTP query using ; delimiters to exceed the intended parameter count, potentially causing performance degradation or exhaustion of resources (denial of service).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The overall severity of this flaw is Moderate, because most Rack applications are not directly impacted. The vulnerability primarily affects applications or middleware that invoke Rack::QueryParser directly using its default configuration, which accepts both \u0026 and ; as parameter delimiters. This behavior can lead to excessive CPU or memory consumption, resulting only a limited denial-of-service condition.\n\nFor typical applications using Rack::Request, the default request-handling flow applies safe parsing logic and does not exhibit the vulnerable behavior.\n\nIn summary, while the theoretical severity is High, the practical impact is generally Moderate to Low for standard configurations.\n\n```\nAffectedness:\n\nIt should be noted that starting from Rack v3.x, the framework no longer splits query parameters on semicolons. This change was introduced in commit ef1fc0c44e6a4b77c8fcf9b4f3bfa09f04ae8482, effectively mitigating this issue in newer releases.\n\nRack 1.x is also not affected by this vulnerability. The vulnerable parsing logic was introduced in Rack 2.x; earlier versions use a simpler query parsing mechanism that does not expose the same resource exhaustion risk.\n```\n\n~~~\nAdditionally, Ruby 2.x and 3.x versions shipped with Red Hat Enterprise Linux are not affected, as they do not bundle the rack RubyGem by default. Rack is a third-party gem that must be installed separately.\n~~~",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-59830"
        },
        {
          "category": "external",
          "summary": "RHBZ#2398167",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2398167"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-59830",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-59830"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-59830",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59830"
        },
        {
          "category": "external",
          "summary": "https://github.com/rack/rack/commit/54e4ffdd5affebcb0c015cc6ae74635c0831ed71",
          "url": "https://github.com/rack/rack/commit/54e4ffdd5affebcb0c015cc6ae74635c0831ed71"
        },
        {
          "category": "external",
          "summary": "https://github.com/rack/rack/security/advisories/GHSA-625h-95r8-8xpm",
          "url": "https://github.com/rack/rack/security/advisories/GHSA-625h-95r8-8xpm"
        }
      ],
      "release_date": "2025-09-25T14:37:06.967000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-11-04T17:06:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:19719"
        },
        {
          "category": "workaround",
          "details": "No action is required for typical Rack applications that use the framework\u2019s default request-handling mechanisms, as these are not impacted.\n\nFor custom implementations or middleware that directly invoke Rack::QueryParser, administrators should:\n\nUse explicit delimiters: Configure QueryParser to use a specific delimiter (e.g. \u0026) rather than accepting both \u0026 and ;.\n\nLimit request size and parameters: Enforce request size and parameter count limits at upstream layers (such as a web server, reverse proxy, or WAF) to prevent excessive resource consumption.\n\nPrefer safe APIs: Use Rack::Request or other higher-level request parsing APIs, which apply safe defaults and avoid this vulnerability.",
          "product_ids": [
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters"
    },
    {
      "cve": "CVE-2025-61770",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2025-10-07T15:01:10.718770+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2402174"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` buffers the entire multipart preamble (bytes before the first boundary) in memory without any size limit. A client can send a large preamble followed by a valid boundary, causing significant memory use and potential process termination due to out-of-memory (OOM) conditions. Remote attackers can trigger large transient memory spikes by including a long preamble in multipart/form-data requests. The impact scales with allowed request sizes and concurrency, potentially causing worker crashes or severe slowdown due to garbage collection. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a preamble size limit (e.g., 16 KiB) or discard preamble data entirely. Workarounds include limiting total request body size at the proxy or web server level and monitoring memory and set per-process limits to prevent OOM conditions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rack: Rack\u0027s unbounded multipart preamble buffering enables DoS (memory exhaustion)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is IMPORTANT because the vulnerability can be exploited over a network and can cause denial of service on such applications that run the vulnerable Rack code. By sending multipart requests with large preambles, an attacker can exhaust memory resources or crash worker processes, leading to service downtime.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61770"
        },
        {
          "category": "external",
          "summary": "RHBZ#2402174",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402174"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61770",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61770"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61770",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61770"
        },
        {
          "category": "external",
          "summary": "https://github.com/rack/rack/commit/589127f4ac8b5cf11cf88fb0cd116ffed4d2181e",
          "url": "https://github.com/rack/rack/commit/589127f4ac8b5cf11cf88fb0cd116ffed4d2181e"
        },
        {
          "category": "external",
          "summary": "https://github.com/rack/rack/commit/d869fed663b113b95a74ad53e1b5cae6ab31f29e",
          "url": "https://github.com/rack/rack/commit/d869fed663b113b95a74ad53e1b5cae6ab31f29e"
        },
        {
          "category": "external",
          "summary": "https://github.com/rack/rack/commit/e08f78c656c9394d6737c022bde087e0f33336fd",
          "url": "https://github.com/rack/rack/commit/e08f78c656c9394d6737c022bde087e0f33336fd"
        },
        {
          "category": "external",
          "summary": "https://github.com/rack/rack/security/advisories/GHSA-p543-xpfm-54cp",
          "url": "https://github.com/rack/rack/security/advisories/GHSA-p543-xpfm-54cp"
        }
      ],
      "release_date": "2025-10-07T14:30:04.552000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-11-04T17:06:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:19719"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rack: Rack\u0027s unbounded multipart preamble buffering enables DoS (memory exhaustion)"
    },
    {
      "cve": "CVE-2025-61771",
      "cwe": {
        "id": "CWE-1284",
        "name": "Improper Validation of Specified Quantity in Input"
      },
      "discovery_date": "2025-10-07T15:01:16.223161+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2402175"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, ``Rack::Multipart::Parser` stores non-file form fields (parts without a `filename`) entirely in memory as Ruby `String` objects. A single large text field in a multipart/form-data request (hundreds of megabytes or more) can consume equivalent process memory, potentially leading to out-of-memory (OOM) conditions and denial of service (DoS). Attackers can send large non-file fields to trigger excessive memory usage. Impact scales with request size and concurrency, potentially leading to worker crashes or severe garbage-collection overhead. All Rack applications processing multipart form submissions are affected. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a reasonable size cap for non-file fields (e.g., 2 MiB). Workarounds include restricting maximum request body size at the web-server or proxy layer (e.g., Nginx `client_max_body_size`) and validating and rejecting unusually large form fields at the application level.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rack: Rack\u0027s multipart parser buffers large non\u2011file fields entirely in memory, enabling DoS (memory exhaustion)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The impact is IMPORTANT because this happens over a network and causes a denial of service. Large non-file fields are buffered in memory instead of being streamed or capped, leading to memory exhaustion and worker crashes.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61771"
        },
        {
          "category": "external",
          "summary": "RHBZ#2402175",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402175"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61771",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61771"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61771",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61771"
        },
        {
          "category": "external",
          "summary": "https://github.com/rack/rack/commit/589127f4ac8b5cf11cf88fb0cd116ffed4d2181e",
          "url": "https://github.com/rack/rack/commit/589127f4ac8b5cf11cf88fb0cd116ffed4d2181e"
        },
        {
          "category": "external",
          "summary": "https://github.com/rack/rack/commit/d869fed663b113b95a74ad53e1b5cae6ab31f29e",
          "url": "https://github.com/rack/rack/commit/d869fed663b113b95a74ad53e1b5cae6ab31f29e"
        },
        {
          "category": "external",
          "summary": "https://github.com/rack/rack/commit/e08f78c656c9394d6737c022bde087e0f33336fd",
          "url": "https://github.com/rack/rack/commit/e08f78c656c9394d6737c022bde087e0f33336fd"
        },
        {
          "category": "external",
          "summary": "https://github.com/rack/rack/security/advisories/GHSA-w9pc-fmgc-vxvw",
          "url": "https://github.com/rack/rack/security/advisories/GHSA-w9pc-fmgc-vxvw"
        }
      ],
      "release_date": "2025-10-07T14:42:53.366000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-11-04T17:06:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:19719"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rack: Rack\u0027s multipart parser buffers large non\u2011file fields entirely in memory, enabling DoS (memory exhaustion)"
    },
    {
      "cve": "CVE-2025-61772",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2025-10-07T16:01:57.118202+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2402200"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, `Rack::Multipart::Parser` can accumulate unbounded data when a multipart part\u2019s header block never terminates with the required blank line (`CRLFCRLF`). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected. Versions 2.2.19, 3.1.17, and 3.2.2 cap per-part header size (e.g., 64 KiB). As a workaround, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx `client_max_body_size`).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rack: Rack memory exhaustion denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The availability risk to Red Hat systems is limited to the application which has integrated rack. The host operating system availability is not at risk.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61772"
        },
        {
          "category": "external",
          "summary": "RHBZ#2402200",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402200"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61772",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61772"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61772",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61772"
        },
        {
          "category": "external",
          "summary": "https://github.com/rack/rack/commit/589127f4ac8b5cf11cf88fb0cd116ffed4d2181e",
          "url": "https://github.com/rack/rack/commit/589127f4ac8b5cf11cf88fb0cd116ffed4d2181e"
        },
        {
          "category": "external",
          "summary": "https://github.com/rack/rack/commit/d869fed663b113b95a74ad53e1b5cae6ab31f29e",
          "url": "https://github.com/rack/rack/commit/d869fed663b113b95a74ad53e1b5cae6ab31f29e"
        },
        {
          "category": "external",
          "summary": "https://github.com/rack/rack/commit/e08f78c656c9394d6737c022bde087e0f33336fd",
          "url": "https://github.com/rack/rack/commit/e08f78c656c9394d6737c022bde087e0f33336fd"
        },
        {
          "category": "external",
          "summary": "https://github.com/rack/rack/security/advisories/GHSA-wpv5-97wm-hp9c",
          "url": "https://github.com/rack/rack/security/advisories/GHSA-wpv5-97wm-hp9c"
        }
      ],
      "release_date": "2025-10-07T15:02:09.895000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-11-04T17:06:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:19719"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rack: Rack memory exhaustion denial of service"
    },
    {
      "cve": "CVE-2025-61919",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2025-10-10T20:01:19.001907+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2403180"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A memory-exhaustion vulnerability exists in Rack when parsing application/x-www-form-urlencoded request bodies. Rack::Request#POST reads the entire request body into memory without enforcing a maximum length or cap. Attackers can exploit this by sending large form submissions, potentially causing denial of service (DoS) through memory exhaustion. Even with configured parsing limits, the issue occurs before those limits are enforced, allowing unbounded memory allocation proportional to request size.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "~~~\n\nAffectedness:\n\nRack 1.x, including 1.6.x, is not affected by this vulnerability. The issue exists only in Rack 2.x and 3.x, where request parsing was refactored into the QueryParser component. Since Rack 1.x does not include this component, it does not contain the vulnerable logic.\n\nRuby 2.x and 3.x versions shipped with Red Hat Enterprise Linux, Red Hat Openshift Core OS (RHOCS) and Red Hat In-Vehicle OS (RHIVOS) are not affected, as they do not bundle the rack RubyGem by default. Rack is a third-party gem that must be installed separately.\n\n~~~",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
          "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
          "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-61919"
        },
        {
          "category": "external",
          "summary": "RHBZ#2403180",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2403180"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-61919",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-61919"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61919",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61919"
        },
        {
          "category": "external",
          "summary": "https://github.com/rack/rack/commit/4e2c903991a790ee211a3021808ff4fd6fe82881",
          "url": "https://github.com/rack/rack/commit/4e2c903991a790ee211a3021808ff4fd6fe82881"
        },
        {
          "category": "external",
          "summary": "https://github.com/rack/rack/commit/cbd541e8a3d0c5830a3c9a30d3718ce2e124f9db",
          "url": "https://github.com/rack/rack/commit/cbd541e8a3d0c5830a3c9a30d3718ce2e124f9db"
        },
        {
          "category": "external",
          "summary": "https://github.com/rack/rack/commit/e179614c4a653283286f5f046428cbb85f21146f",
          "url": "https://github.com/rack/rack/commit/e179614c4a653283286f5f046428cbb85f21146f"
        },
        {
          "category": "external",
          "summary": "https://github.com/rack/rack/security/advisories/GHSA-6xw4-3v39-52mm",
          "url": "https://github.com/rack/rack/security/advisories/GHSA-6xw4-3v39-52mm"
        }
      ],
      "release_date": "2025-10-10T19:22:42.454000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-11-04T17:06:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:19719"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available that meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability beyond these configuration-based workarounds.",
          "product_ids": [
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "HighAvailability-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.src",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-0:0.10.18-2.el8_10.7.x86_64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.aarch64",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.ppc64le",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.s390x",
            "ResilientStorage-8.10.0.Z.MAIN.EUS:pcs-snmp-0:0.10.18-2.el8_10.7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rubygem-rack: Unbounded read in `Rack::Request` form parsing can lead to memory exhaustion"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.