AIKIDO-2025-10296

TL;DR

Affected versions of the package are vulnerable to denial of service (DoS) due to unbounded parameter parsing in Rack::QueryParser, which can result in memory exhaustion. In the patched version, support was added for limiting the parameter using the environment variables RACK_QUERY_PARSER_PARAMS_LIMIT and RACK_QUERY_PARSER_BYTESIZE_LIMIT (default limits of 4096 parameters and 4MB total byte size), as well as through QueryParser constructor options. If either limit is exceeded, a Rack::QueryParser::QueryLimitError is raised, with ParamsTooDeepError now aliased for compatibility with existing error handling.