CVE-2026-125110 Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-125110?
CVE-2026-125110 is a medium-severity vulnerability in rack, published on 9 Nov 2026.
Official description
Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.clean_path_info normalization but evaluates header_rules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encoded dot segments and receive it without path-specific security headers such as Content-Disposition or Content-Security-Policy. Applications that do not use path-specific header_rules are not affected. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8.
Weakness: CWE-180
Which versions are affected by CVE-2026-125110?
3 open source packages ship an affected version, including rack.
| Package | Affected | Fixed in |
|---|---|---|
rack RubyGems | All versions | 2.2.25 |
rack RubyGems | From 3.0.0 | 3.1.23 |
rack RubyGems | From 3.2.0 | 3.2.8 |
How do I fix CVE-2026-125110?
Upgrade rack to a fixed version for your release line: 2.2.25, 3.1.23 or 3.2.8.
Is CVE-2026-125110 being exploited?
There is no known exploitation of CVE-2026-125110 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-125110, GHSA-wvg4-6p58-3gh3, UBUNTU-CVE-2026-125110.