Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection. This vulnerability is fixed in 2.2.12, 3.0.13, and 3.1.11.
CVSS Details
- CVSS 4.0 Base Score: 6.9 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade pcs-snmpUpgrade pcs-debuginfoUpgrade pcs | Apr 17, 2025 | Mar 4, 2025 |
| Debian | — | Upgrade ruby-rack | Mar 26, 2025 | Mar 4, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 4, 2025 |
| Suse | — | Upgrade ruby2.5-rubygem-rack-docUpgrade ruby2.5-rubygem-rack-testsuite-1_6Upgrade ruby2.5-rubygem-rack-testsuiteUpgrade ruby2.5-rubygem-rackUpgrade ruby2.5-rubygem-rack-doc-1_6Upgrade ruby2.5-rubygem-rack-1_6 | Dec 5, 2025 | Mar 14, 2025 |
| Ubuntu | — | Upgrade ruby-rackUpgrade ruby-rack (Ubuntu Pro) | Mar 26, 2025 | Mar 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub