DEBIAN-CVE-2026-125109: Medium severity debian/ruby-rack vulnerability
Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Request#hostwithport, #baseurl, and #url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use these methods for absolute URLs, redirects, or origin-dependent checks can emit attacker-chosen delimiters, enabling redirect manipulation, string-based allowlist bypass, or unescaped markup reflection. Rails overrides these methods and is not expected to be affected. This issue is fixed in versions 3.1.23 and 3.2.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ruby-rackto a version that resolves this vulnerability.Fixed in 3.2.8-1 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.1.23 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.2.8
Event History
Frequently Asked Questions
Which applications are most likely to be exposed?
Applications using Rack versions from 3.0 up to, but not including, 3.1.23 or 3.2.8 may be exposed if they use Rack::Request#host_with_port, #base_url, or #url to construct absolute URLs, redirects, or origin-dependent checks without an independent host allowlist. Rails overrides these methods and is not expected to be affected.
What input does an attacker need to control?
An attacker must be able to supply a Host, X-Forwarded-Host, or Forwarded host= value containing an invalid authority. The affected Rack request methods can return that authority verbatim.
What are the potential effects in an affected application?
The issue can enable redirect manipulation, bypasses of string-based allowlists, or reflection of unescaped markup when the application uses the affected values in relevant URL, redirect, validation, or rendering logic. The stated impact is limited confidentiality and integrity impact, with no availability impact.
What versions contain the fix?
The issue is fixed in Rack 3.1.23 and 3.2.8. Applications should also maintain an independent allowlist of accepted hosts where host-derived values influence security decisions or generated absolute URLs.