GHSA-2j8w-xcrc-x985: Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835
Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Request#hostwithport, #baseurl, and #url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use these methods for absolute URLs, redirects, or origin-dependent checks can emit attacker-chosen delimiters, enabling redirect manipulation, string-based allowlist bypass, or unescaped markup reflection. Rails overrides these methods and is not expected to be affected. This issue is fixed in versions 3.1.23 and 3.2.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.1.23 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.2.8
Event History
Frequently Asked Questions
Which applications are most exposed?
Applications that do not independently allowlist hosts and use Rack request URL helpers to construct absolute URLs, redirects, or origin-dependent checks are most exposed. Rails overrides these methods and is not expected to be affected.
What request headers can supply the attacker-controlled value?
The value can come from the Host header, X-Forwarded-Host header, or the host parameter in a Forwarded header. The affected methods can return an invalid authority from these inputs verbatim.
How can I determine whether my application needs remediation?
Check whether the application uses Rack 3.0 through versions before 3.1.23 or 3.2.8, and whether it calls host_with_port, base_url, or url. Prioritize cases where those values are used without an independent host allowlist.
What can be done if an upgrade is not immediately possible?
Apply an independent host allowlist before using request-derived host values for URL generation, redirects, or origin checks. This reduces exposure to attacker-controlled invalid authorities.
Which versions contain the fix?
The issue is fixed in Rack 3.1.23 and 3.2.8.