EUVD-2026-122936

Action Pack is a framework for handling and responding to web requests. From 8.1 until 8.1.4.1, Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remoteip from Rack::Requestforwardedfor, which under Rack 3 reads the RFC 7239 Forwarded header in preference to X-Forwarded-For. When a...

CVE-2026-126083

The Action Pack framework (Rails 8.1.0 through 8.1.4) is vulnerable to IP spoofing when running with Rack 3 . The vulnerability exists because ActionDispatch::RemoteIp derives request.remote_ip from Rack::Request#forwarded_for, which prioritizes the RFC 7239 Forwarded header over X-Forwarded-For....