GHSA-mr3q-g2mv-mr4q

Suggest an improvement
Source
https://github.com/advisories/GHSA-mr3q-g2mv-mr4q
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-mr3q-g2mv-mr4q/GHSA-mr3q-g2mv-mr4q.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-mr3q-g2mv-mr4q
Aliases
Downstream
Related
Published
2025-10-10T20:28:47Z
Modified
2025-10-15T07:45:09.222033Z
Severity
  • 2.7 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
Sinatra is vulnerable to ReDoS through ETag header value generation
Details

Summary

There is a denial of service vulnerability in the If-Match and If-None-Match header parsing component of Sinatra, if the etag method is used when constructing the response and you are using Ruby < 3.2.

Details

Carefully crafted input can cause If-Match and If-None-Match header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the ETag header value. Any applications that use the etag method when generating a response are impacted if they are using Ruby below version 3.2.

Resources

  • https://github.com/sinatra/sinatra/issues/2120 (report)
  • https://github.com/sinatra/sinatra/pull/2121 (fix)
  • https://github.com/sinatra/sinatra/pull/1823 (older ReDoS vulnerability)
  • https://bugs.ruby-lang.org/issues/19104 (fix in Ruby >= 3.2)
Database specific 
{
    "cwe_ids": [
        "CWE-1333",
        "CWE-400"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "nvd_published_at": "2025-10-10T20:15:38Z",
    "github_reviewed_at": "2025-10-10T20:28:47Z"
}
References

Affected packages

RubyGems / sinatra

Package

Name
sinatra
Purl
pkg:gem/sinatra

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.2.0

Affected versions

0.*

0.1.0
0.1.5
0.1.6
0.1.7
0.2.0
0.2.1
0.2.2
0.3.0
0.3.1
0.3.2
0.3.3
0.9.0
0.9.0.1
0.9.0.2
0.9.0.3
0.9.0.4
0.9.0.5
0.9.1
0.9.1.1
0.9.2
0.9.4
0.9.5
0.9.6

1.*

1.0.a
1.0.b
1.0
1.1.a
1.1.b
1.1.0
1.1.2
1.1.3
1.1.4
1.2.0.a
1.2.0.c
1.2.0.d
1.2.0
1.2.1
1.2.2
1.2.3
1.2.6
1.2.7
1.2.8
1.2.9
1.3.0.a
1.3.0.b
1.3.0.c
1.3.0.d
1.3.0.e
1.3.0.f
1.3.0.g
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.4.0.a
1.4.0.b
1.4.0.c
1.4.0.d
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8

2.*

2.0.0.beta1
2.0.0.beta2
2.0.0.rc1
2.0.0.rc2
2.0.0.rc5
2.0.0.rc6
2.0.0
2.0.1.rc1
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.8.1
2.1.0
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4

3.*

3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.1.0
3.2.0

4.*

4.0.0
4.0.1
4.1.0
4.1.1