{"action":"Upgrade sinatra to 4.2.0 or later.","affected":[{"fixed":"4.2.0","introduced":"0"}],"component":"sinatra","cve_ids":["CVE-2025-61921"],"ecosystem":"RubyGems","epss":0.00495,"exploited":false,"fixed_versions":["4.2.0"],"ghsa_id":"GHSA-mr3q-g2mv-mr4q","id":"tcs_01M5KEMB7Q5H5GT3QSMM53Z25X","modified_at":"2026-09-10T03:50:30.082629594Z","published_at":"2025-10-10T20:28:47Z","references":["https://osv.dev/vulnerability/GHSA-mr3q-g2mv-mr4q","https://github.com/sinatra/sinatra/security/advisories/GHSA-mr3q-g2mv-mr4q","https://nvd.nist.gov/vuln/detail/CVE-2025-61921","https://github.com/sinatra/sinatra/issues/2120","https://github.com/sinatra/sinatra/pull/1823","https://github.com/sinatra/sinatra/pull/2121","https://github.com/sinatra/sinatra/commit/3fe8c38dc405586f7ad8f2ac748aa53e9c3615bd","https://github.com/sinatra/sinatra/commit/8ff496bd4877520599e1479d6efead39304edceb","https://bugs.ruby-lang.org/issues/19104","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sinatra/CVE-2025-61921.yml","https://github.com/sinatra/sinatra"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-mr3q-g2mv-mr4q","url":"https://osv.dev/vulnerability/GHSA-mr3q-g2mv-mr4q"},{"source":"nvd","source_id":"CVE-2025-61921","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61921"}],"summary":"Sinatra is vulnerable to ReDoS through ETag header value generation"}