CVE-2025-61921

HighCVSS 7.5

Published: 10/10/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

41th percentile - higher than 41% of all known CVEs

Summary

Sinatra versions prior to 4.2.0 have a denial of service vulnerability in the If-Match and If-None-Match header parsing component when the etag method is used to construct responses. Carefully crafted input can cause parsing to take an unexpected amount of time.

Risk Assessment

An attacker may trigger a denial of service vector by overloading the application with requests containing crafted headers.

Recommendation

Update Sinatra to version 4.2.0. Until updated, consider restricting or validating If-Match and If-None-Match headers at the proxy level.

Other vulnerabilities in Sinatra

CVE-2024-21510Medium
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into this header. If used for caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header, attackers can potentially exploit Cache Poisoning or Routing-based SSRF.

Original NVD description (English source)

Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS