UBUNTU-CVE-2026-125109: Medium severity ubuntu/ruby-rack vulnerability
Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Request#hostwithport, #baseurl, and #url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use these methods for absolute URLs, redirects, or origin-dependent checks can emit attacker-chosen delimiters, enabling redirect manipulation, string-based allowlist bypass, or unescaped markup reflection. Rails overrides these methods and is not expected to be affected. This issue is fixed in versions 3.1.23 and 3.2.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.1.23 - Upgrade
Upgrade
Rackto a version that resolves this vulnerability.Fixed in 3.2.8
Event History
Frequently Asked Questions
Which applications are most likely to be exposed?
Applications using Rack’s Request#host_with_port, #base_url, or #url to construct absolute URLs, redirects, or origin-dependent checks are exposed if they do not independently enforce a host allowlist. Rails overrides these methods and is not expected to be affected.
What request control does an attacker need?
An attacker needs to be able to supply a crafted Host, X-Forwarded-Host, or Forwarded host= value. The vulnerable methods can return an invalid authority from those headers verbatim.
Are default deployments necessarily affected?
No. Exploitation depends on the application using the affected Rack request methods in a security-relevant context and lacking an independent host allowlist.
What can be done before updating Rack?
Enforce an independent allowlist for accepted host values and avoid using unvalidated Host, X-Forwarded-Host, or Forwarded host= values when generating absolute URLs, redirects, or performing origin-dependent checks.
Which Rack versions contain the fix?
The issue is fixed in Rack 3.1.23 and 3.2.8. The affected range is Rack 3.0 through versions before 3.1.23 and 3.2.8.