vulnerability
Ubuntu: (Multiple Advisories) (CVE-2025-27111): Rack vulnerabilities
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 8 | (AV:N/AC:L/Au:N/C:N/I:C/A:N) | Mar 4, 2025 | Mar 26, 2025 | Apr 16, 2026 |
Severity
8
CVSS
(AV:N/AC:L/Au:N/C:N/I:C/A:N)
Published
Mar 4, 2025
Added
Mar 26, 2025
Modified
Apr 16, 2026
Description
Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection. This vulnerability is fixed in 2.2.12, 3.0.13, and 3.1.11.
Solutions
ubuntu-pro-upgrade-ruby-rackubuntu-upgrade-ruby-rack
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.