CVE-2026-125109: Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835
Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Request#hostwithport, #baseurl, and #url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use these methods for absolute URLs, redirects, or origin-dependent checks can emit attacker-chosen delimiters, enabling redirect manipulation, string-based allowlist bypass, or unescaped markup reflection. Rails overrides these methods and is not expected to be affected. This issue is fixed in versions 3.1.23 and 3.2.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.1.23 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.2.8
Event History
Frequently Asked Questions
Which deployments are most exposed?
Applications using Rack directly are affected if they use Rack::Request#host_with_port, #base_url, or #url to construct absolute URLs, redirects, or perform origin-dependent checks without an independent host allowlist. Rails overrides these methods and is not expected to be affected.
What attacker-controlled inputs can trigger the issue?
An attacker can supply an invalid authority through the Host header, X-Forwarded-Host header, or the host= parameter in the Forwarded header. Exploitation does not require authentication or user interaction, but has high attack complexity.
What should be done if an immediate upgrade is not possible?
Apply an independent allowlist for accepted hosts before using these Rack request methods in absolute URLs, redirects, or origin checks. Avoid reflecting values returned by these methods into markup unless they are appropriately handled.
How can I determine whether my Rack version is fixed?
The issue is fixed in Rack 3.1.23 and 3.2.8. Versions from 3.0 up to those fixed releases are affected.