CVE-2026-125109 Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-125109?
CVE-2026-125109 is a medium-severity vulnerability in rack, published on 9 Nov 2026.
Official description
Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Request#host_with_port, #base_url, and #url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use these methods for absolute URLs, redirects, or origin-dependent checks can emit attacker-chosen delimiters, enabling redirect manipulation, string-based allowlist bypass, or unescaped markup reflection. Rails overrides these methods and is not expected to be affected. This issue is fixed in versions 3.1.23 and 3.2.8.
Weakness: CWE-1286
Which versions are affected by CVE-2026-125109?
2 open source packages ship an affected version, including rack.
| Package | Affected | Fixed in |
|---|---|---|
rack RubyGems | From 3.0.0 | 3.1.23 |
rack RubyGems | From 3.2.0 | 3.2.8 |
How do I fix CVE-2026-125109?
Upgrade rack to a fixed version for your release line: 3.1.23 or 3.2.8.
Is CVE-2026-125109 being exploited?
There is no known exploitation of CVE-2026-125109 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-125109, GHSA-2j8w-xcrc-x985, UBUNTU-CVE-2026-125109.