CVE-2025-61921

CVE-2025-61921 describes a denial-of-service vulnerability in Sinatra, a Ruby web application framework, affecting versions prior to 4.2.0. This flaw arises from inefficient parsing of the If-Match and If-None-Match HTTP headers when the etag method is used in response generation. A carefully crafted input can lead to prolonged processing times, creating a denial-of-service attack vector. With a CVSS score of 7.5 (High), this vulnerability is network-exploitable with low attack complexity and no user interaction required, leading to a high impact on availability. The EPSS score is low, indicating a low probability of exploitation in the wild. Currently, there is no evidence of active exploitation, nor are there any public exploit modules available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a lack of widespread attention.