CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2025-61921

Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the `ETag` header value. Any applications that use the `etag` method when generating a response are impacted. Version 4.2.0 fixes the issue.

Score
2.7 low
Published
2025-10-10
Links
NVD · cve.org

Matched ports (3)

PortPackageVersionStatusMaintainer
www/rubygem-sinatra1rubygem-sinatra11.4.8unaddressedsunpoet@FreeBSD.org
www/rubygem-sinatra2rubygem-sinatra22.2.4_1unaddressedsunpoet@FreeBSD.org
www/rubygem-sinatra3rubygem-sinatra33.2.0_1unaddressedruby@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>rubygem-sinatra1</name>
	<range><lt>4.2.0</lt></range>
      </package>
      <package>
	<name>rubygem-sinatra2</name>
	<range><lt>4.2.0</lt></range>
      </package>
      <package>
	<name>rubygem-sinatra3</name>
	<range><lt>4.2.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Sinatra is a domain-specific language for creating web applications in
	Ruby. In versions prior to 4.2.0, there is a denial of service
	vulnerability in the `If-Match` and `If-None-Match` header parsing
	component of Sinatra, if the `etag` method is used when constructing
	the response. Carefully crafted input can cause `If-Match` and
	`If-None-Match` header parsing in Sinatra to take an unexpected amount
	of time, possibly resulting in a denial of service attack vector. This
	header is typically involved in generating the `ETag` header value.
	Any applications that use the `etag` method when generating a response
	are impacted. Version 4.2.0 fixes the issue.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2025-61921</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-61921</url>
    </references>
    <dates>
      <discovery>2025-10-10</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>