CVE-2025-61921

Date: October 10, 2025

Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the "If-Match" and "If-None-Match" header parsing component of Sinatra, if the "etag" method is used when constructing the response. Carefully crafted input can cause "If-Match" and "If-None-Match" header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically involved in generating the "ETag" header value. Any applications that use the "etag" method when generating a response are impacted. Version 4.2.0 fixes the issue.