CVE-2025-61921 Sinatra has ReDoS vulnerability in ETag header value generation
Attackers can cause denial of service in Sinatra applications using the etag method via crafted If-Match or If-None-Match headers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-61921?
CVE-2025-61921 is a low-severity denial of service vulnerability in sinatra, published on 10 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.
Weakness: CWE-1333
Which versions are affected by CVE-2025-61921?
2 open source packages ship an affected version, including sinatra. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sinatra RubyGems | All versions | 4.2.0 |
sinatra RubyGems | All versions | 4.2.0 |
Products include Sinatrarb Sinatra.
How do I fix CVE-2025-61921?
Upgrade sinatra to 4.2.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-61921 being exploited?
There is no known exploitation of CVE-2025-61921 in the wild and no public exploit code.
Other vulnerabilities in sinatra
Sources
Also known as CLEANSTART-2026-VS84759, DEBIAN-CVE-2025-61921, GHSA-mr3q-g2mv-mr4q, MINI-2f8v-qc34-5q3v, MINI-5fxm-34fj-4r3x, MINI-83c6-vmrq-xcpj and 18 more.