GHSA-2J8W-XCRC-X985 Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835

Summary Rack::Requesthostwithport, and therefore baseurl and url, return the raw authority string when it fails validation. An attacker-controlled Host, X-Forwarded-Host, or Forwarded: host= value containing characters that are not permitted in an authority is embedded verbatim in URLs generated ...

EUVD-2026-120482

Rack: Rack::Requesthostwithport and baseurl / url return the raw invalid Host header — incomplete fix of CVE-2026-34835...

CVE-2026-125109

Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Requesthostwithport, baseurl, and url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use thes...

DEBIAN-CVE-2026-125109

Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Requesthostwithport, baseurl, and url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use thes...

CVE-2026-125109

Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Requesthostwithport, baseurl, and url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use thes...

CVE-2026-125109

Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Requesthostwithport, baseurl, and url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use thes...

CVE-2026-125109

The Rack modular Ruby web server interface is vulnerable in versions 3.0 through 3.1.23 and 3.2.8 . The Rack::Request#host_with_port, #base_url, and #url methods can return an attacker-controlled invalid authority derived verbatim from the Host, X-Forwarded-Host, or Forwarded: host= headers. If a...

CVE-2026-125109: rack: Rack is a modular Ruby web server interface

Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Requesthostwithport, baseurl, and url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use thes...

CVE-2026-114362

A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument baseurl can lead to server-side request forgery. The attack may be performed from remote. Upgrading to...

CVE-2026-114362 HarnessRouter Targets Test Endpoint app.py server-side request forgery

A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument baseurl can lead to server-side request forgery. The attack may be performed from remote. Upgrading to...

CVE-2026-114362

The HarnessRouter software (versions up to 0.31.12 ) contains a Server-Side Request Forgery (SSRF) vulnerability within the Targets Test Endpoint component. Specifically, a flaw in an unknown function of the gateway/app.py file allows an attacker to perform a remote manipulation of the base_url a...

CVE-2026-114362 HarnessRouter Targets Test Endpoint app.py server-side request forgery

A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument baseurl can lead to server-side request forgery. The attack may be performed from remote. Upgrading to...

EUVD-2026-107502

A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument baseurl can lead to server-side request forgery. The attack may be performed from remote. Upgrading to...

CVE-2026-114362

A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument baseurl can lead to server-side request forgery. The attack may be performed from remote. Upgrading to...

CVE-2026-114362 HarnessRouter Targets Test Endpoint app.py server-side request forgery

A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument baseurl can lead to server-side request forgery. The attack may be performed from remote. Upgrading to...

HarnessRouter server request forgery vulnerability

HarnessRouter versions 0.31.12 and earlier contain a server-side request forgery vulnerability. This vulnerability stems from improper handling of the baseurl parameter by an unknown function within the gateway/app.py file in the Targets Test Endpoint component, potentially enabling remote...

ptbsare Anx Calibre Manager server request forgery vulnerability

PTBSare Anx Calibre Manager versions 1.13.12 and earlier contain a server-side request forgery vulnerability. This vulnerability stems from improper handling of the baseurl parameter within the LLMClient.chat function in the file blueprints/api/llm.py within the LLM Configuration Handler componen...

EUVD-2026-102478

ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an unvalidated provider baseurl. Attackers can set baseurl via the provider config endpoint and trigger POST /api/v1/models/check to...

CVE-2026-111320 ValueCell through 0.1.20 Unauthenticated SSRF via /api/v1/models/check

ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an unvalidated provider baseurl. Attackers can set baseurl via the provider config endpoint and trigger POST /api/v1/models/check to...

CVE-2026-111320 ValueCell through 0.1.20 Unauthenticated SSRF via /api/v1/models/check

ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an unvalidated provider baseurl. Attackers can set baseurl via the provider config endpoint and trigger POST /api/v1/models/check to...