{"id":"GHSA-mr3q-g2mv-mr4q","summary":"Sinatra is vulnerable to ReDoS through ETag header value generation","details":"### Summary\n\nThere is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response and you are using Ruby \u003c 3.2.\n\n### Details\n\nCarefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted if they are using Ruby below version 3.2.\n\n### Resources\n\n* https://github.com/sinatra/sinatra/issues/2120 (report)\n* https://github.com/sinatra/sinatra/pull/2121 (fix)\n* https://github.com/sinatra/sinatra/pull/1823 (older ReDoS vulnerability)\n* https://bugs.ruby-lang.org/issues/19104 (fix in Ruby \u003e= 3.2)","aliases":["CVE-2025-61921"],"modified":"2026-09-10T03:50:30.082629594Z","published":"2025-10-10T20:28:47Z","database_specific":{"nvd_published_at":"2025-10-10T20:15:38Z","cwe_ids":["CWE-1333","CWE-400"],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2025-10-10T20:28:47Z"},"references":[{"type":"WEB","url":"https://github.com/sinatra/sinatra/security/advisories/GHSA-mr3q-g2mv-mr4q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61921"},{"type":"WEB","url":"https://github.com/sinatra/sinatra/issues/2120"},{"type":"WEB","url":"https://github.com/sinatra/sinatra/pull/1823"},{"type":"WEB","url":"https://github.com/sinatra/sinatra/pull/2121"},{"type":"WEB","url":"https://github.com/sinatra/sinatra/commit/3fe8c38dc405586f7ad8f2ac748aa53e9c3615bd"},{"type":"WEB","url":"https://github.com/sinatra/sinatra/commit/8ff496bd4877520599e1479d6efead39304edceb"},{"type":"WEB","url":"https://bugs.ruby-lang.org/issues/19104"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sinatra/CVE-2025-61921.yml"},{"type":"PACKAGE","url":"https://github.com/sinatra/sinatra"}],"affected":[{"package":{"name":"sinatra","ecosystem":"RubyGems","purl":"pkg:gem/sinatra"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0"}]}],"versions":["0.1.0","0.1.5","0.1.6","0.1.7","0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.3.2","0.3.3","0.9.0","0.9.0.1","0.9.0.2","0.9.0.3","0.9.0.4","0.9.0.5","0.9.1","0.9.1.1","0.9.2","0.9.4","0.9.5","0.9.6","1.0","1.0.a","1.0.b","1.1.0","1.1.2","1.1.3","1.1.4","1.1.a","1.1.b","1.2.0","1.2.0.a","1.2.0.c","1.2.0.d","1.2.1","1.2.2","1.2.3","1.2.6","1.2.7","1.2.8","1.2.9","1.3.0","1.3.0.a","1.3.0.b","1.3.0.c","1.3.0.d","1.3.0.e","1.3.0.f","1.3.0.g","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.4.0","1.4.0.a","1.4.0.b","1.4.0.c","1.4.0.d","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","2.0.0","2.0.0.beta1","2.0.0.beta2","2.0.0.rc1","2.0.0.rc2","2.0.0.rc5","2.0.0.rc6","2.0.1","2.0.1.rc1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.8.1","2.1.0","2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.1.0","3.2.0","4.0.0","4.0.1","4.1.0","4.1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-mr3q-g2mv-mr4q/GHSA-mr3q-g2mv-mr4q.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"}]}