CVE-2025-26803
The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP m...
Original description
The description as published by the source.
The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
passenger-nginx-module
[{"type":"SEMVER","events":[{"introduced":"6.0.21"},{"fixed":"6.0.26"}]}]
Bitnami
passenger-apache-module
[{"type":"SEMVER","events":[{"introduced":"6.0.21"},{"fixed":"6.0.26"}]}]
Bitnami
passenger
[{"type":"SEMVER","events":[{"introduced":"6.0.21"},{"fixed":"6.0.26"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-26803 passenger Fixed in: 6.0.26+ds-1
- Ubuntu UBUNTU-CVE-2025-26803 passenger
References
- advisory nvd.nist.gov
- advisory github.com
- patch github.com
- web blog.phusion.nl
- web github.com
- web github.com
- web phusionpassenger.com