UBUNTU-CVE-2026-125110: Medium severity ubuntu/ruby-rack vulnerability
Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.cleanpathinfo normalization but evaluates headerrules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encoded dot segments and receive it without path-specific security headers such as Content-Disposition or Content-Security-Policy. Applications that do not use path-specific headerrules are not affected. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rackto a version that resolves this vulnerability.Fixed in 2.2.25 - Upgrade
Upgrade
rackto a version that resolves this vulnerability.Fixed in 3.1.23 - Upgrade
Upgrade
rackto a version that resolves this vulnerability.Fixed in 3.2.8
Event History
Frequently Asked Questions
Which deployments are affected in practice?
Only applications using Rack::Static with path-specific header_rules are affected. Applications that do not use path-specific header_rules are not affected.
What does an attacker need to exploit this issue?
An attacker does not need to authenticate. They need to request a known file using raw or percent-encoded dot segments so that the normalized path is served while header_rules are evaluated against a differently decoded path.
What is the impact of a successful request?
The requested known file may be returned without the security headers configured for its path, such as Content-Disposition or Content-Security-Policy.
Which Rack versions contain the fix?
The issue is fixed in Rack 2.2.25, 3.1.23, and 3.2.8.