UBUNTU-CVE-2026-32762: Medium severity ubuntu/ruby-rack vulnerability
Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21 and 3.2.0 to before 3.2.6, Rack::Utils.forwardedvalues parses the RFC 7239 Forwarded header by splitting on semicolons before handling quoted-string values. Because quoted values may legally contain semicolons, a header can be interpreted by Rack as multiple Forwarded directives rather than as a single quoted for value. In deployments where an upstream proxy, WAF, or intermediary validates or preserves quoted Forwarded values differently, this discrepancy can allow an attacker to smuggle host, proto, for, or by parameters through a single header value. This issue has been patched in versions 3.1.21 and 3.2.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/ruby-rackto a version that resolves this vulnerability.Fixed in 3.1.16-0.1ubuntu0.3 - Upgrade
Upgrade
rackto a version that resolves this vulnerability.Fixed in 3.1.21 - Upgrade
Upgrade
rackto a version that resolves this vulnerability.Fixed in 3.2.6
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
Exposure depends on a proxy, WAF, or other intermediary handling RFC 7239 Forwarded headers differently from Rack, particularly when it validates or preserves quoted values. The impact arises from the discrepancy between that component and Rack's parsing of semicolons inside quoted values.
What does an attacker need to exploit it?
An attacker needs to send a crafted Forwarded header containing a quoted value with semicolons. The differing interpretation can cause Rack to treat content from one quoted value as separate host, proto, for, or by directives.
Are all affected Rack releases vulnerable?
The affected ranges are Rack 3.0.0.beta1 through versions before 3.1.21, and Rack 3.2.0 through versions before 3.2.6. The issue is patched in 3.1.21 and 3.2.6.