What’s Vulnerable › Vulnerabilities

CVE-2025-26803

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-24 · updated 2026-06-17
• Weakness: CWE-908

Description

The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.

Affected products

• Phusion Passenger: from 6.0.21 before 6.0.26 — fixed in 6.0.26

How to fix

Upgrade to a fixed version: Phusion Passenger 6.0.26. Check the vendor advisory for mitigations.

References

• https://blog.phusion.nl/2025/02/19/passenger-6-0-26/
• https://github.com/phusion/passenger/commit/bb15591646687064ab2d578d5f9660b2a4168017
• https://github.com/phusion/passenger/compare/release-6.0.25...release-6.0.26
• https://github.com/phusion/passenger/releases/tag/release-6.0.26
• https://www.phusionpassenger.com/support

Get alerted when CVE-2025-26803 or the next vulnerability affects your stack