Rack up to 3.1.22/3.2.7 Request host_with_port/base_url/url Host/X-Forwarded-Host/Forwarded redirect

Summaryinfo

A vulnerability was found in Rack up to 3.1.22/3.2.7. It has been classified as problematic. The affected element is the function host_with_port/base_url/url of the component Request. This manipulation of the argument Host/X-Forwarded-Host/Forwarded causes redirect. This vulnerability is tracked as CVE-2026-125109. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Rack up to 3.1.22/3.2.7 and classified as problematic. Affected by this vulnerability is the function host_with_port/base_url/url of the component Request. The manipulation of the argument Host/X-Forwarded-Host/Forwarded with an unknown input leads to a redirect vulnerability. The CWE definition for the vulnerability is CWE-601. The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. As an impact it is known to affect integrity. The summary by CVE is:

Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Request#host_with_port, #base_url, and #url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use these methods for absolute URLs, redirects, or origin-dependent checks can emit attacker-chosen delimiters, enabling redirect manipulation, string-based allowlist bypass, or unescaped markup reflection. Rails overrides these methods and is not expected to be affected. This issue is fixed in versions 3.1.23 and 3.2.8.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-125109 since 11/09/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1204.001 for this issue.

Upgrading to version 3.1.23 or 3.2.8 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Rack

Version

• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4
• 3.1.5
• 3.1.6
• 3.1.7
• 3.1.8
• 3.1.9
• 3.1.10
• 3.1.11
• 3.1.12
• 3.1.13
• 3.1.14
• 3.1.15
• 3.1.16
• 3.1.17
• 3.1.18
• 3.1.19
• 3.1.20
• 3.1.21
• 3.1.22
• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.2.5
• 3.2.6
• 3.2.7

Website

• Product: https://github.com/rack/rack/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion