Code Injection and Redirect Manipulation in Rack Web Server Interface
CVE-2026-125109
4.8MEDIUM
What is CVE-2026-125109?
The Rack web server interface is susceptible to a vulnerability that allows for the potential manipulation of redirects and invalid authority framing. Specifically, versions from 3.0 to 3.1.23 and 3.2.0 to 3.2.8 are affected by methods such as Rack::Request#host_with_port, #base_url, and #url returning attacker-controlled inputs from Host, X-Forwarded-Host, or Forwarded headers. Applications lacking a robust host allowlist may improperly handle these inputs, leading to serious security risks including redirect manipulation and allowlist bypass. The issue has been addressed in versions 3.1.23 and 3.2.8, reinforcing the importance of updating to secure versions.
Affected Version(s)
rack >= 3.0, < 3.1.23 < 3.0, 3.1.23
rack >= 3.2, < 3.2.8 < 3.2, 3.2.8