Vulnerability-Lookup

Vulnerability from cleanstart

Published

2026-04-01 10:08

Modified

2026-03-03 09:43

Summary

Security fixes for CVE-2025-61770, CVE-2025-61771, CVE-2025-61772, CVE-2025-61919, CVE-2026-25500, ghsa-22h5-pq3x-2gf2, ghsa-2xgq-q749-89fq, ghsa-4cx2-fc23-5wg6, ghsa-6xw4-3v39-52mm, ghsa-72qj-48g4-5xgx, ghsa-c2f4-jgmc-q2r5, ghsa-gh9q-2xrm-x6qv, ghsa-mhwm-jh88-3gjf, ghsa-mr3q-g2mv-mr4q, ghsa-mxw3-3hh2-x2mh, ghsa-p543-xpfm-54cp, ghsa-vc5p-v9hr-52mj, ghsa-vqg5-3255-v292, ghsa-w9pc-fmgc-vxvw, ghsa-whrj-4476-wvmp, ghsa-wpv5-97wm-hp9c applied in versions: 9.0.8-r2, 9.0.8-r3, 9.0.8-r4, 9.2.6-r0

Details

Multiple security vulnerabilities affect the logstash-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2025-61770	WEB
	https://osv.dev/vulnerability/CVE-2025-61771	WEB
	https://osv.dev/vulnerability/CVE-2025-61772	WEB
	https://osv.dev/vulnerability/CVE-2025-61919	WEB
	https://osv.dev/vulnerability/CVE-2026-25500	WEB
	https://osv.dev/vulnerability/ghsa-22h5-pq3x-2gf2	WEB
	https://osv.dev/vulnerability/ghsa-2xgq-q749-89fq	WEB
	https://osv.dev/vulnerability/ghsa-4cx2-fc23-5wg6	WEB
	https://osv.dev/vulnerability/ghsa-6xw4-3v39-52mm	WEB
	https://osv.dev/vulnerability/ghsa-72qj-48g4-5xgx	WEB
	https://osv.dev/vulnerability/ghsa-c2f4-jgmc-q2r5	WEB
	https://osv.dev/vulnerability/ghsa-gh9q-2xrm-x6qv	WEB
	https://osv.dev/vulnerability/ghsa-mhwm-jh88-3gjf	WEB
	https://osv.dev/vulnerability/ghsa-mr3q-g2mv-mr4q	WEB
	https://osv.dev/vulnerability/ghsa-mxw3-3hh2-x2mh	WEB
	https://osv.dev/vulnerability/ghsa-p543-xpfm-54cp	WEB
	https://osv.dev/vulnerability/ghsa-vc5p-v9hr-52mj	WEB
	https://osv.dev/vulnerability/ghsa-vqg5-3255-v292	WEB
	https://osv.dev/vulnerability/ghsa-w9pc-fmgc-vxvw	WEB
	https://osv.dev/vulnerability/ghsa-whrj-4476-wvmp	WEB
	https://osv.dev/vulnerability/ghsa-wpv5-97wm-hp9c	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2025-61770	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2025-61771	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2025-61772	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2025-61919	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-25500	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "logstash-fips"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.2.6-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Multiple security vulnerabilities affect the logstash-fips package. These issues are resolved in later releases. See references for individual vulnerability details.",
  "id": "CLEANSTART-2026-YD79647",
  "modified": "2026-03-03T09:43:57Z",
  "published": "2026-04-01T10:08:19.513245Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-YD79647.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2025-61770"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2025-61771"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2025-61772"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2025-61919"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-25500"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-22h5-pq3x-2gf2"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-2xgq-q749-89fq"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-4cx2-fc23-5wg6"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-6xw4-3v39-52mm"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-72qj-48g4-5xgx"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-c2f4-jgmc-q2r5"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-gh9q-2xrm-x6qv"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-mhwm-jh88-3gjf"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-mr3q-g2mv-mr4q"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-mxw3-3hh2-x2mh"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-p543-xpfm-54cp"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-vc5p-v9hr-52mj"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-vqg5-3255-v292"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-w9pc-fmgc-vxvw"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-whrj-4476-wvmp"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-wpv5-97wm-hp9c"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61770"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61771"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61772"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61919"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25500"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes for CVE-2025-61770, CVE-2025-61771, CVE-2025-61772, CVE-2025-61919, CVE-2026-25500, ghsa-22h5-pq3x-2gf2, ghsa-2xgq-q749-89fq, ghsa-4cx2-fc23-5wg6, ghsa-6xw4-3v39-52mm, ghsa-72qj-48g4-5xgx, ghsa-c2f4-jgmc-q2r5, ghsa-gh9q-2xrm-x6qv, ghsa-mhwm-jh88-3gjf, ghsa-mr3q-g2mv-mr4q, ghsa-mxw3-3hh2-x2mh, ghsa-p543-xpfm-54cp, ghsa-vc5p-v9hr-52mj, ghsa-vqg5-3255-v292, ghsa-w9pc-fmgc-vxvw, ghsa-whrj-4476-wvmp, ghsa-wpv5-97wm-hp9c applied in versions: 9.0.8-r2, 9.0.8-r3, 9.0.8-r4, 9.2.6-r0",
  "upstream": [
    "CVE-2025-61770",
    "CVE-2025-61771",
    "CVE-2025-61772",
    "CVE-2025-61919",
    "CVE-2026-25500",
    "ghsa-22h5-pq3x-2gf2",
    "ghsa-2xgq-q749-89fq",
    "ghsa-4cx2-fc23-5wg6",
    "ghsa-6xw4-3v39-52mm",
    "ghsa-72qj-48g4-5xgx",
    "ghsa-c2f4-jgmc-q2r5",
    "ghsa-gh9q-2xrm-x6qv",
    "ghsa-mhwm-jh88-3gjf",
    "ghsa-mr3q-g2mv-mr4q",
    "ghsa-mxw3-3hh2-x2mh",
    "ghsa-p543-xpfm-54cp",
    "ghsa-vc5p-v9hr-52mj",
    "ghsa-vqg5-3255-v292",
    "ghsa-w9pc-fmgc-vxvw",
    "ghsa-whrj-4476-wvmp",
    "ghsa-wpv5-97wm-hp9c"
  ]
}

GHSA-WPV5-97WM-HP9C

Vulnerability from github – Published: 2025-10-07 17:28 – Updated: 2025-10-13 15:30

Summary

Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

Details

Summary

Rack::Multipart::Parser can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (CRLFCRLF). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS).

Details

While reading multipart headers, the parser waits for CRLFCRLF using:

@sbuf.scan_until(/(.*?\r\n)\r\n/m)

If the terminator never appears, it continues appending data (@sbuf.concat(content)) indefinitely. There is no limit on accumulated header bytes, so a single malformed part can consume memory proportional to the request body size.

Impact

Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected.

Mitigation

Upgrade to a patched Rack version that caps per-part header size (e.g., 64 KiB).
Until then, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx client_max_body_size).

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "rack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.19"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "rack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1"
            },
            {
              "fixed": "3.1.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "rack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.2"
            },
            {
              "fixed": "3.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-61772"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-07T17:28:06Z",
    "nvd_published_at": "2025-10-07T15:16:03Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`Rack::Multipart::Parser` can accumulate unbounded data when a multipart part\u2019s header block never terminates with the required blank line (`CRLFCRLF`). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS).\n\n## Details\n\nWhile reading multipart headers, the parser waits for `CRLFCRLF` using:\n\n```ruby\n@sbuf.scan_until(/(.*?\\r\\n)\\r\\n/m)\n```\n\nIf the terminator never appears, it continues appending data (`@sbuf.concat(content)`) indefinitely. There is no limit on accumulated header bytes, so a single malformed part can consume memory proportional to the request body size.\n\n## Impact\n\nAttackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected.\n\n## Mitigation\n\n* Upgrade to a patched Rack version that caps per-part header size (e.g., 64 KiB).\n* Until then, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx `client_max_body_size`).",
  "id": "GHSA-wpv5-97wm-hp9c",
  "modified": "2025-10-13T15:30:01Z",
  "published": "2025-10-07T17:28:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rack/rack/security/advisories/GHSA-wpv5-97wm-hp9c"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61772"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rack/rack/commit/589127f4ac8b5cf11cf88fb0cd116ffed4d2181e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rack/rack/commit/d869fed663b113b95a74ad53e1b5cae6ab31f29e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rack/rack/commit/e08f78c656c9394d6737c022bde087e0f33336fd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rack/rack"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-61772.yml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Rack\u0027s multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

Vulnerability from cleanstart

GHSA-WPV5-97WM-HP9C

Summary

Details

Impact

Mitigation

Tags

Sightings

Nomenclature