CVE-2026-125110

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.cleanpathinfo normalization but evaluates headerrules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encode...

UBUNTU-CVE-2026-125110

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.cleanpathinfo normalization but evaluates headerrules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encode...

Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch

Summary Rack::Static normalizes the request path with Utils.cleanpathinfo when deciding which file to serve, but matches headerrules against a path that is only URL-decoded. A request containing dot segments, raw or percent-encoded, is served the normalized target file while the header rules for...

EUVD-2026-120484

Rack: Rack::Static headerrules bypass via dot-segment normalization mismatch...

GHSA-WVG4-6P58-3GH3 Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch

Summary Rack::Static normalizes the request path with Utils.cleanpathinfo when deciding which file to serve, but matches headerrules against a path that is only URL-decoded. A request containing dot segments, raw or percent-encoded, is served the normalized target file while the header rules for...

CVE-2026-125110

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.cleanpathinfo normalization but evaluates headerrules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encode...

Linux Distros Unpatched Vulnerability : CVE-2026-125110

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.cleanpathinfo normalization but evaluate...

DEBIAN-CVE-2026-125110

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.cleanpathinfo normalization but evaluates headerrules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encode...

CVE-2026-125110

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.cleanpathinfo normalization but evaluates headerrules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encode...

CVE-2026-125110

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.cleanpathinfo normalization but evaluates headerrules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encode...

CVE-2026-125110 Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.cleanpathinfo normalization but evaluates headerrules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encode...

CVE-2026-125110

The Rack Ruby web server interface is vulnerable to a path normalization mismatch in Rack::Static prior to versions 2.2.25 , 3.1.23 , and 3.2.8 . The issue occurs because the component serves a path after Utils.clean_path_info normalization but evaluates header_rules against a path that is only U...

CVE-2026-125110 Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.cleanpathinfo normalization but evaluates headerrules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encode...

PT-2026-141154

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.25 Rack versions prior to 3.1.23 Rack versions prior to 3.2.8 Description Rack::Static serves a path after Utils.clean path info normalization but evaluates header rules against a path that is only URL-decoded. This...

CVE-2026-125110: rack: Rack is a modular Ruby web server interface

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.cleanpathinfo normalization but evaluates headerrules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encode...

Astra Linux – vulnerability in ruby-rack

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Staticapplicablerules evaluates several headerrules types against the raw URL-encoded PATHINFO; the underlying file-serving path is then decoded prior to serving the file. As a result, a request for a...

Astra Linux – vulnerability in ruby-rack

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determined whether a request should be served as a static file by checking for a simple string prefix. When configured with URL prefixes such as “/css”, it matched any request path that began wi...

GHSA-Q4QF-9J86-F5MH Rack:: Static header_rules bypass via URL-encoded paths

Summary Rack::Staticapplicablerules evaluates several headerrules types against the raw URL-encoded PATHINFO, while the underlying file-serving path is decoded before the file is served. As a result, a request for a URL-encoded variant of a static path can serve the same file without the headers...

Rack:: Static header_rules bypass via URL-encoded paths

Summary Rack::Staticapplicablerules evaluates several headerrules types against the raw URL-encoded PATHINFO, while the underlying file-serving path is decoded before the file is served. As a result, a request for a URL-encoded variant of a static path can serve the same file without the headers...

Rack::Static prefix matching can expose unintended files under the static root

Summary Rack::Static determines whether a request should be served as a static file using a simple string prefix check. When configured with URL prefixes such as "/css", it matches any request path that begins with that string, including unrelated paths such as "/css-config.env" or...