MEDIUM 5.3 RubyGems
Phusion Passenger denial of service
GHSA-2cj2-qqxj-5m3r · BIT-passenger-2025-26803 · BIT-passenger-apache-module-2025-26803 · BIT-passenger-nginx-module-2025-26803 · CVE-2025-26803
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-26803
- WEB https://github.com/phusion/passenger/commit/bb15591646687064ab2d578d5f9660b2a4168017
- WEB https://blog.phusion.nl/2025/02/19/passenger-6-0-26
- PACKAGE https://github.com/phusion/passenger
- WEB https://github.com/phusion/passenger/compare/release-6.0.25...release-6.0.26
- WEB https://github.com/phusion/passenger/releases/tag/release-6.0.26
- WEB https://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2025-26803.yml
- WEB https://www.phusionpassenger.com/support
Ready to move
Start Securing
Free, no credit card | First findings in minutes