Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-125110

Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.clean_path_info normalization but evaluates header_rules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encoded dot segments and receive it without path-specific security headers such as Content-Disposition or Content-Security-Policy. Applications that do not use path-specific header_rules are not affected. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

rack rack

  • < 2.2.25affected
  • >= 3.0, < 3.1.23affected
  • >= 3.2, < 3.2.8affected

References