[DRE-maint] Bug#1116431: ruby-rack: CVE-2025-59830

[Salvatore Bonaccorso]

Source: ruby-rack
Version: 3.1.16-0.1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
Control: found -1 2.2.13-1~deb12u1

Hi,

The following vulnerability was published for ruby-rack.

CVE-2025-59830[0]:
| Rack is a modular Ruby web server interface. Prior to version
| 2.2.18, Rack::QueryParser enforces its params_limit only for
| parameters separated by &, while still splitting on both & and ;. As
| a result, attackers could use ; separators to bypass the parameter
| count limit and submit more parameters than intended. Applications
| or middleware that directly invoke Rack::QueryParser with its
| default configuration (no explicit delimiter) could be exposed to
| increased CPU and memory consumption. This can be abused as a
| limited denial-of-service vector. This issue has been patched in
| version 2.2.18.

I'm not entirely sure here, I think the issue is still present in the
current unstable version but might have been fixed upstream while
reworking, around f904fff079c7 ("Add `Rack::Request#form_pairs`
(#2351)") in v3.2.0. Is this correct?

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-59830
    https://www.cve.org/CVERecord?id=CVE-2025-59830
[1] https://github.com/rack/rack/security/advisories/GHSA-625h-95r8-8xpm
[2] https://github.com/rack/rack/commit/54e4ffdd5affebcb0c015cc6ae74635c0831ed71

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore