The vulnerability in the Rack::Sendfile class of the module interface between web servers and Rack web applications allows a perpetrator to gain unauthorized access to protected information.

🗓️ 07 Nov 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 3 Views

Vulnerability in Rack::Sendfile enables remote attackers to access protected information via crafted headers.

Reporter	Title	Published	Views	Family All 83
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	30 Oct 202517:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Aspera Console	8 Jan 202616:47	–	ibm
ATTACKERKB	CVE-2026-7381	29 Apr 202622:13	–	attackerkb
Chainguard	CVE-2025-61780 vulnerabilities	15 Oct 202514:11	–	cgr
CNNVD	Rack 安全漏洞	10 Oct 202500:00	–	cnnvd
CVE	CVE-2025-61780	10 Oct 202516:53	–	cve
Cvelist	CVE-2025-61780 Rack has Possible Information Disclosure Vulnerability	10 Oct 202516:53	–	cvelist
Debian	[SECURITY] [DLA 4357-1] ruby-rack security update	2 Nov 202521:02	–	debian
Debian	[SECURITY] [DSA 6048-1] ruby-rack security update	3 Nov 202522:02	–	debian
Debian CVE	CVE-2025-61780	10 Oct 202516:53	–	debiancve

Vulners

Node

red_hat red_hat_3scale_api_management_platformMatch2

OR

red_hat openshift_service_meshMatch2

OR

red_hat red_hat_satelliteMatch6

OR

leah_neukirchen rackRange<2.2.20

OR

leah_neukirchen rackRange3.0–3.1.18

OR

leah_neukirchen rackRange3.2–3.2.3

OR

novell opensuse_leapMatch15.5

OR

novell opensuse_leapMatch15.3

OR

novell opensuse_leapMatch15.4

OR

red_hat red_hat_enterprise_linuxMatch9

OR

novell opensuse_leapMatch15.6

OR

red_hat red_hat_enterprise_linuxMatch10

Source	Link
github	www.github.com/rack/rack/commit/57277b7741581fa827472c5c666f6e6a33abd784
github	www.github.com/rack/rack/commit/7e69f65eefe9cd2868df9f9f3b0977b86f93523a
github	www.github.com/rack/rack/commit/fba2c8bc63eb787ff4b19bc612d315fda6126d85
github	www.github.com/rack/rack/security/advisories/GHSA-r657-rxjc-j557
access	www.access.redhat.com/security/cve/cve-2025-61780
security-tracker	www.security-tracker.debian.org/tracker/CVE-2025-61780
suse	www.suse.com/security/cve/CVE-2025-61780.html
redos	www.redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-rubygem-rack-06112025/
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/3.1/
web	www.web.nvd.nist.gov/view/vuln/detail

04 Mar 2026 00:00Current

5.9Medium risk

Vulners AI Score5.9

CVSS 25

CVSS 35.8

EPSS0.0044

Rack Sendfile vulnerability remote attackers unauthorized access protected information crafted headers