Ubuntu alert USN-8624-1 (ruby-sinatra)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8624-1] Sinatra vulnerability
Date:
             
 
Thu, 30 Jul 2026 15:14:04 +0000
Message-ID:
             
 
<E1wpSSS-0006Aa-2e@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8624-1
July 29, 2026

ruby-sinatra vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Sinatra could be made to crash if it received specially crafted network
traffic.

Software Description:
- ruby-sinatra: Ruby web-development dressed in a DSL

Details:

It was discovered that Sinatra did not properly handle header parsing,
causing ETag generation to hang when given specific input. A remote
attacker could possibly use this issue to cause a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
  ruby-sinatra                    2.0.8.1-2+deb11u1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 20.04 LTS
  ruby-sinatra                    2.0.8.1-1ubuntu0.1~esm3
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  ruby-sinatra                    1.4.8-1ubuntu0.1~esm3
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  ruby-sinatra                    1.4.7-3ubuntu0.1~esm3
                                  Available with Ubuntu Pro

After a standard system update you need to restart any applications that
use ruby-sinatra to make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8624-1
  CVE-2025-61921


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmprZycACgkQcpJm3tlz
hgEw0A//b/wfUpQFvtPUKKSwk/lpQfNvHR5OlgTDnTy5Ne8tGrC7jsArpdg6Vcr6
L1PPslie8ikLN0ndwpBJHG9JhHYnAYUuvTVBtCwboc4yD5+hDwhDu3/+txfbkEzM
qVmokAVDxcgjrzDI5l2caL59DBms8WXRjI8lgBlCkddEZkHBFDnzs6KJeAqIOa+2
J9R573lOkIyatz4mT1dU4HiaNd5G4caclIg3E3Q+r0DjJ38tTKay7eWWoZEEZlMP
Fhcb2CdoFrLeqgDVYHqGLNdckfQL/SQEoLliyOGGHVB97OpYx7NkgOzu6vk47Vp9
tNEeCZMxGrJrBB6YKLWSIQgeehDx00UG+4nr7QsyHW0JO1Vyz9P2XPcqKJnl9bQO
F3LC9gZhMHIy+hcxil6bqfSMY/halcunjWfJlFb9GKTRi5Iw4O9WQsCSuLuPTe5d
SkqNqpKflAFGHhWcmg/yfFEVu907ICJrjg17TFXCiCuKIqycVYbuxE9x/PA3gp3o
uJkTHnrlXrH/UQRsH5EbIL8M3yni/L3HEf6gC0nOQwZPIp150rK3oPrsnKwHW9mu
hgyGQHn6CWiagkAdEShuXrG0iTp1WkceTI+IPIw2uPf5l0NqMkz9mUlTUs+WfP6/
RDHBMEoGAdO5t+ymtZvOFUMfv2PEwsfZvypcjryUUObD0//sBK4=
=ezQQ
-----END PGP SIGNATURE-----