CVE-2025-26803CWE-908

The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method

Medium · published February 24, 2025

CVSS v3.1
5.3
EPSS
1%
Percentile
48.9
In the wild
Unconfirmed
What it is

The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00617 · 48.9th percentile
Weakness
CWE-908 · Use of Uninitialized Resource
Published
2025-02-24T00:00Z
EPSS history
Timeline
  • 24 FEB 00:00Z
    The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method
    cvelistv5