How severe is CVE-2015-3225?

CVE-2015-3225 has a CVSS 2.0 base score of 5.0, rated medium severity.

Is CVE-2015-3225 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 8% (94th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2015-3225?

CVE-2015-3225 primarily affects Rack Project Rack. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2015-3225?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2015-3225 published?

CVE-2015-3225 was published on 2015-07-26 and last updated on 2026-06-17.

CVE-2015-3225

CVE-2015-3225 is a medium-severity vulnerability in Rack Project Rack with a CVSS 2.0 base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-19.

Key facts

Severity: Medium (CVSS 2.0 base score 5.0)
EPSS exploit prediction: 8% (94th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-19
Affected product: Rack Project Rack
Published: 2015-07-26
Last modified: 2026-06-17

Description

lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.

Frequently asked questions

What is CVE-2015-3225?: lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.
How severe is CVE-2015-3225?: CVE-2015-3225 has a CVSS 2.0 base score of 5.0, rated medium severity.
Is CVE-2015-3225 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 8% (94th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2015-3225?: CVE-2015-3225 primarily affects Rack Project Rack. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2015-3225?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2015-3225 published?: CVE-2015-3225 was published on 2015-07-26 and last updated on 2026-06-17.

References

Affected products (7)

cpe:2.3:a:rack_project:rack:*:*:*:*:*:*:*:*
cpe:2.3:a:rack_project:rack:1.6.0:*:*:*:*:*:*:*
cpe:2.3:a:rack_project:rack:1.6.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

More vulnerabilities in Rack Project Rack

CVE-2022-30123 — Critical (CVSS 10.0): A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell…
CVE-2020-8161 — High (CVSS 8.6): A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal…
CVE-2022-30122 — High (CVSS 7.5): A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing…
CVE-2020-8184 — High (CVSS 7.5): A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4…
CVE-2018-16470 — High (CVSS 7.5): There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can…
CVE-2018-16471 — Medium (CVSS 6.1): There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data…

All CVEs affecting Rack Project Rack →

Other CWE-19 vulnerabilities

CVE-2015-2373 — Critical (CVSS 10.0): The Remote Desktop Protocol (RDP) server service in Microsoft Windows 7 SP1, Windows 8, and Windows Server 2012 allows…
CVE-2014-8822 — Critical (CVSS 10.0): IOHIDFamily in Apple OS X before 10.10.2 allows attackers to execute arbitrary code in a kernel context or cause a…
CVE-2014-8817 — Critical (CVSS 10.0): coresymbolicationd in CoreSymbolication in Apple OS X before 10.10.2 does not verify that expected data types are…
CVE-2014-4488 — Critical (CVSS 10.0): IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly validate…
CVE-2014-7247 — Critical (CVSS 10.0): Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6, 7, 2008, 2009, and 2010;…
CVE-1999-0226 — Critical (CVSS 10.0): Windows NT TCP/IP processes fragmented IP packets improperly, causing a denial of service.

Browse all CWE-19 vulnerabilities →