CVE-2025-61921
published 2025-10-10CVE-2025-61921: Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.50%
42.2th percentile
Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ruby-sinatra | < ruby-sinatra 3.0.5-3+deb12u1 (bookworm) | ruby-sinatra 3.0.5-3+deb12u1 (bookworm) |
| sinatra | sinatra | < 4.2.0 | 4.2.0 |
| sinatra | sinatra | >= 0 < 4.2.0 | 4.2.0 |
| sinatrarb | sinatra | < 4.2.0 | 4.2.0 |
| ubuntu | ruby-sinatra | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.02.7LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv2.7LOW
vendor_debian2.7LOW
vendor_redhat2.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Sinatra vulnerability
vendor_ubuntu·2026-07-29
CVE-2025-61921 Sinatra vulnerability
Title: Sinatra vulnerability
Summary: Sinatra could be made to crash if it received specially crafted network
traffic.
It was discovered that Sinatra did not properly handle header parsing,
causing ETag generation to hang when given specific input. A remote
attacker could possibly use this issue to cause a denial of service.
Instructions: After a standard system update you need to restart any applications that
use ruby-sinatra to make all the necessary changes.
Red Hat
sinatra: Sinatra has ReDoS vulnerability in ETag header value generation
vendor_redhat·2025-10-10·CVSS 2.7
CVE-2025-61921 [LOW] CWE-1333 sinatra: Sinatra has ReDoS vulnerability in ETag header value generation
sinatra: Sinatra has ReDoS vulnerability in ETag header value generation
Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.
A flaw was found in Sinatra. A Regular Expression Denial of Servic
Debian
CVE-2025-61921: ruby-sinatra - Sinatra is a domain-specific language for creating web applications in Ruby. In ...
vendor_debian·2025·CVSS 2.7
CVE-2025-61921 [LOW] CVE-2025-61921: ruby-sinatra - Sinatra is a domain-specific language for creating web applications in Ruby. In ...
Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.
Scope: local
bookworm: resolved (fixed in 3.0.5-3+deb12u1)
bullseye: open
forky: resolved (fixed in 4.2.1-1)
sid: resolved (fixed in 4.2.1-1)
GHSA
Sinatra is vulnerable to ReDoS through ETag header value generation
ghsa·2025-10-10
CVE-2025-61921 [LOW] CWE-1333 Sinatra is vulnerable to ReDoS through ETag header value generation
Sinatra is vulnerable to ReDoS through ETag header value generation
### Summary
There is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response and you are using Ruby = 3.2)
OSV
CVE-2025-61921: Sinatra is a domain-specific language for creating web applications in Ruby
osv·2025-10-10·CVSS 2.7
CVE-2025-61921 [LOW] CVE-2025-61921: Sinatra is a domain-specific language for creating web applications in Ruby
Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.
OSV
Sinatra is vulnerable to ReDoS through ETag header value generation
osv·2025-10-10
CVE-2025-61921 [LOW] Sinatra is vulnerable to ReDoS through ETag header value generation
Sinatra is vulnerable to ReDoS through ETag header value generation
### Summary
There is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response and you are using Ruby = 3.2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-10
Published