stimulus-rails-1.3.4.gem: 10 vulnerabilities (highest severity is: 7.5)

[mend-for-github-com]

Vulnerable Library - stimulus-rails-1.3.4.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.1.12.gem

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (stimulus-rails version)	Remediation Possible**
CVE-2025-61919	High	7.5	rack-3.1.12.gem	Transitive	N/A*	❌
CVE-2025-61772	High	7.5	rack-3.1.12.gem	Transitive	N/A*	❌
CVE-2025-61771	High	7.5	rack-3.1.12.gem	Transitive	N/A*	❌
CVE-2025-61770	High	7.5	rack-3.1.12.gem	Transitive	N/A*	❌
CVE-2025-46727	High	7.5	rack-3.1.12.gem	Transitive	N/A*	❌
CVE-2025-61780	Medium	5.8	rack-3.1.12.gem	Transitive	N/A*	❌
CVE-2025-49007	Medium	5.3	rack-3.1.12.gem	Transitive	N/A*	❌
CVE-2025-46336	Medium	4.2	rack-session-2.1.0.gem	Transitive	N/A*	❌
CVE-2025-32441	Medium	4.2	rack-session-2.1.0.gem	Transitive	N/A*	❌
CVE-2025-54314	Low	2.8	thor-1.3.2.gem	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2025-61919

Vulnerable Library - rack-3.1.12.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-3.1.12.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.1.12.gem

Dependency Hierarchy:

• stimulus-rails-1.3.4.gem (Root Library)
  • railties-8.0.2.gem
    • rackup-2.2.1.gem
      • ❌ rack-3.1.12.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, "Rack::Request#POST" reads the entire request body into memory for "Content-Type: application/x-www-form-urlencoded", calling "rack.input.read(nil)" without enforcing a length or cap. Large request bodies can therefore be buffered completely into process memory before parsing, leading to denial of service (DoS) through memory exhaustion. Users should upgrade to Rack version 2.2.20, 3.1.18, or 3.2.3, anu of which enforces form parameter limits using "query_parser.bytesize_limit", preventing unbounded reads of "application/x-www-form-urlencoded" bodies. Additionally, enforce strict maximum body size at the proxy or web server layer (e.g., Nginx "client_max_body_size", Apache "LimitRequestBody").

Publish Date: 2025-10-10

URL: CVE-2025-61919

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2025-61772

Vulnerable Library - rack-3.1.12.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-3.1.12.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.1.12.gem

Dependency Hierarchy:

• stimulus-rails-1.3.4.gem (Root Library)
  • railties-8.0.2.gem
    • rackup-2.2.1.gem
      • ❌ rack-3.1.12.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, "Rack::Multipart::Parser" can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line ("CRLFCRLF"). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected. Versions 2.2.19, 3.1.17, and 3.2.2 cap per-part header size (e.g., 64 KiB). As a workaround, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx "client_max_body_size").

Publish Date: 2025-10-07

URL: CVE-2025-61772

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-10-07

Fix Resolution: https://github.com/rack/rack.git - v3.2.2

CVE-2025-61771

Vulnerable Library - rack-3.1.12.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-3.1.12.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.1.12.gem

Dependency Hierarchy:

• stimulus-rails-1.3.4.gem (Root Library)
  • railties-8.0.2.gem
    • rackup-2.2.1.gem
      • ❌ rack-3.1.12.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, ``Rack::Multipart::Parser"stores non-file form fields (parts without a"filename") entirely in memory as Ruby "String"objects. A single large text field in a multipart/form-data request (hundreds of megabytes or more) can consume equivalent process memory, potentially leading to out-of-memory (OOM) conditions and denial of service (DoS). Attackers can send large non-file fields to trigger excessive memory usage. Impact scales with request size and concurrency, potentially leading to worker crashes or severe garbage-collection overhead. All Rack applications processing multipart form submissions are affected. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a reasonable size cap for non-file fields (e.g., 2 MiB). Workarounds include restricting maximum request body size at the web-server or proxy layer (e.g., Nginx"client_max_body_size`) and validating and rejecting unusually large form fields at the application level.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-10-07

URL: CVE-2025-61771

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-10-07

Fix Resolution: https://github.com/rack/rack.git - v3.1.17

CVE-2025-61770

Vulnerable Library - rack-3.1.12.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-3.1.12.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.1.12.gem

Dependency Hierarchy:

• stimulus-rails-1.3.4.gem (Root Library)
  • railties-8.0.2.gem
    • rackup-2.2.1.gem
      • ❌ rack-3.1.12.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, "Rack::Multipart::Parser" buffers the entire multipart preamble (bytes before the first boundary) in memory without any size limit. A client can send a large preamble followed by a valid boundary, causing significant memory use and potential process termination due to out-of-memory (OOM) conditions. Remote attackers can trigger large transient memory spikes by including a long preamble in multipart/form-data requests. The impact scales with allowed request sizes and concurrency, potentially causing worker crashes or severe slowdown due to garbage collection. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a preamble size limit (e.g., 16 KiB) or discard preamble data entirely. Workarounds include limiting total request body size at the proxy or web server level and monitoring memory and set per-process limits to prevent OOM conditions.

Publish Date: 2025-10-07

URL: CVE-2025-61770

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-10-07

Fix Resolution: https://github.com/rack/rack.git - v2.2.19

CVE-2025-46727

Vulnerable Library - rack-3.1.12.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-3.1.12.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.1.12.gem

Dependency Hierarchy:

• stimulus-rails-1.3.4.gem (Root Library)
  • railties-8.0.2.gem
    • rackup-2.2.1.gem
      • ❌ rack-3.1.12.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, "Rack::QueryParser" parses query strings and "application/x-www-form-urlencoded" bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with extremely large numbers of parameters. The vulnerability arises because "Rack::QueryParser" iterates over each "&"-separated key-value pair and adds it to a Hash without enforcing an upper bound on the total number of parameters. This allows an attacker to send a single request containing hundreds of thousands (or more) of parameters, which consumes excessive memory and CPU during parsing. An attacker can trigger denial of service by sending specifically crafted HTTP requests, which can cause memory exhaustion or pin CPU resources, stalling or crashing the Rack server. This results in full service disruption until the affected worker is restarted. Versions 2.2.14, 3.0.16, and 3.1.14 fix the issue. Some other mitigations are available. One may use middleware to enforce a maximum query string size or parameter count, or employ a reverse proxy (such as Nginx) to limit request sizes and reject oversized query strings or bodies. Limiting request body sizes and query string lengths at the web server or CDN level is an effective mitigation.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-05-07

URL: CVE-2025-46727

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-05-07

Fix Resolution: https://github.com/rack/rack.git - v2.2.14

CVE-2025-61780

Vulnerable Library - rack-3.1.12.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-3.1.12.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.1.12.gem

Dependency Hierarchy:

• stimulus-rails-1.3.4.gem (Root Library)
  • railties-8.0.2.gem
    • rackup-2.2.1.gem
      • ❌ rack-3.1.12.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, a possible information disclosure vulnerability existed in "Rack::Sendfile" when running behind a proxy that supports "x-sendfile" headers (such as Nginx). Specially crafted headers could cause "Rack::Sendfile" to miscommunicate with the proxy and trigger unintended internal requests, potentially bypassing proxy-level access restrictions. When "Rack::Sendfile" received untrusted "x-sendfile-type" or "x-accel-mapping" headers from a client, it would interpret them as proxy configuration directives. This could cause the middleware to send a "redirect" response to the proxy, prompting it to reissue a new internal request that was not subject to the proxy's access controls. An attacker could exploit this by setting a crafted "x-sendfile-type: x-accel-redirect" header, setting a crafted "x-accel-mapping" header, and requesting a path that qualifies for proxy-based acceleration. Attackers could bypass proxy-enforced restrictions and access internal endpoints intended to be protected (such as administrative pages). The vulnerability did not allow arbitrary file reads but could expose sensitive application routes. This issue only affected systems meeting all of the following conditions: The application used "Rack::Sendfile" with a proxy that supports "x-accel-redirect" (e.g., Nginx); the proxy did not always set or remove the "x-sendfile-type" and "x-accel-mapping" headers; and the application exposed an endpoint that returned a body responding to ".to_path". Users should upgrade to Rack versions 2.2.20, 3.1.18, or 3.2.3, which require explicit configuration to enable "x-accel-redirect". Alternatively, configure the proxy to always set or strip the header, or in Rails applications, disable sendfile completely.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-10-10

URL: CVE-2025-61780

CVSS 3 Score Details (5.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2025-49007

Vulnerable Library - rack-3.1.12.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-3.1.12.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.1.12.gem

Dependency Hierarchy:

• stimulus-rails-1.3.4.gem (Root Library)
  • railties-8.0.2.gem
    • rackup-2.2.1.gem
      • ❌ rack-3.1.12.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack is a modular Ruby web server interface. Starting in version 3.1.0 and prior to version 3.1.16, there is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This is very similar to the previous security issue CVE-2022-44571. Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted. Version 3.1.16 contains a patch for the vulnerability.

Publish Date: 2025-06-04

URL: CVE-2025-49007

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-47m2-26rw-j2jw

Release Date: 2025-06-04

Fix Resolution: rack - 3.1.16

CVE-2025-46336

Vulnerable Library - rack-session-2.1.0.gem

Library home page: https://rubygems.org/gems/rack-session-2.1.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-session-2.1.0.gem

Dependency Hierarchy:

• stimulus-rails-1.3.4.gem (Root Library)
  • railties-8.0.2.gem
    • actionpack-8.0.2.gem
      • ❌ rack-session-2.1.0.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack::Session is a session management implementation for Rack. In versions starting from 2.0.0 to before 2.1.1, when using the Rack::Session::Pool middleware, and provided the attacker can acquire a session cookie (already a major issue), the session may be restored if the attacker can trigger a long running request (within that same session) adjacent to the user logging out, in order to retain illicit access even after a user has attempted to logout. This issue has been patched in version 2.1.1.

Publish Date: 2025-05-08

URL: CVE-2025-46336

CVSS 3 Score Details (4.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9j94-67jr-4cqj

Release Date: 2025-05-08

Fix Resolution: https://github.com/rack/rack-session.git - v2.1.1

CVE-2025-32441

Vulnerable Library - rack-session-2.1.0.gem

Library home page: https://rubygems.org/gems/rack-session-2.1.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-session-2.1.0.gem

Dependency Hierarchy:

• stimulus-rails-1.3.4.gem (Root Library)
  • railties-8.0.2.gem
    • actionpack-8.0.2.gem
      • ❌ rack-session-2.1.0.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack is a modular Ruby web server interface. Prior to version 2.2.14, when using the "Rack::Session::Pool" middleware, simultaneous rack requests can restore a deleted rack session, which allows the unauthenticated user to occupy that session. Rack session middleware prepares the session at the beginning of request, then saves is back to the store with possible changes applied by host rack application. This way the session becomes to be a subject of race conditions in general sense over concurrent rack requests. When using the "Rack::Session::Pool" middleware, and provided the attacker can acquire a session cookie (already a major issue), the session may be restored if the attacker can trigger a long running request (within that same session) adjacent to the user logging out, in order to retain illicit access even after a user has attempted to logout. Version 2.2.14 contains a patch for the issue. Some other mitigations are available. Either ensure the application invalidates sessions atomically by marking them as logged out e.g., using a "logged_out" flag, instead of deleting them, and check this flag on every request to prevent reuse; or implement a custom session store that tracks session invalidation timestamps and refuses to accept session data if the session was invalidated after the request began.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-05-07

URL: CVE-2025-32441

CVSS 3 Score Details (4.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-05-07

Fix Resolution: https://github.com/rack/rack.git - v2.2.14

CVE-2025-54314

Vulnerable Library - thor-1.3.2.gem

Thor is a toolkit for building powerful command-line interfaces.

Library home page: https://rubygems.org/gems/thor-1.3.2.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/thor-1.3.2.gem

Dependency Hierarchy:

• stimulus-rails-1.3.4.gem (Root Library)
  • railties-8.0.2.gem
    • ❌ thor-1.3.2.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."

Publish Date: 2025-07-20

URL: CVE-2025-54314

CVSS 3 Score Details (2.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-07-20

Fix Resolution: https://github.com/rails/thor.git - v1.4.0