EUVD-2026-120484

Rack: Rack::Static headerrules bypass via dot-segment normalization mismatch...

CVE-2026-125110

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.cleanpathinfo normalization but evaluates headerrules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encode...