CVE-2026-125109: Rack host validation bypass via HTTP headers

CVE-2026-125109 · Severity: medium · CVSS 4.8 · Published 2026-11-09

Rack is a Ruby web server interface used by many web applications to process HTTP requests. Versions 3.0 through 3.1.22 and 3.2.7 allow attackers to inject malicious values through the Host or Forwarded headers, which are then returned unvalidated by critical request methods. This can enable attackers to manipulate redirects, bypass security allowlists, or inject unescaped HTML into responses.

Technologies: rack (RubyGems). Vendors: Rack, RubyGems.

Quick answers

Is CVE-2026-125109 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-125109 being exploited in the wild.
How severe is CVE-2026-125109?
Medium severity, with a CVSS score of 4.8, published 9 November 2026.
Which products and versions are affected?
Rack 3.0 to 3.1.22, 3.2.0 to 3.2.7; rack (RubyGems) >= 3.0.0, < 3.1.23, ECOSYSTEM:introduced=3.0.0,fixed=3.1.23.
Is there a fix for CVE-2026-125109?
Yes. rack (RubyGems): upgrade to 3.1.23 or later. Until then: Applications without an independent host allowlist should validate or sanitize the Host, X-Forwarded-Host, and Forwarded headers before using Rack::Request methods for security-sensitive operations such as redirects or origin checks. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-125109 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-125109?
Check whether you run Rack or rack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • rack (RubyGems): upgrade to 3.1.23 or later
    bundle update rack

Applications without an independent host allowlist should validate or sanitize the Host, X-Forwarded-Host, and Forwarded headers before using Rack::Request methods for security-sensitive operations such as redirects or origin checks.

Technical details

The vulnerability exists in Rack::Request#host_with_port, #base_url, and #url methods, which accept attacker-controlled values from Host, X-Forwarded-Host, or Forwarded headers without proper validation. Applications that use these methods to construct absolute URLs, generate redirects, or perform origin-dependent security checks may reflect the attacker-supplied values directly. The issue affects Rack 3.0–3.1.22 and 3.2.7; Rails applications override these methods and are not vulnerable.

Affected products

  • Rack Rack 3.0 to 3.1.22, 3.2.0 to 3.2.7

Identifiers

  • CVE-2026-125109
  • GHSA-2j8w-xcrc-x985

Timeline

  • 2026-11-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.