CVE-2026-125109

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-125109", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-11-09T17:45:35.935Z", "datePublished": "2026-11-09T21:57:46.924Z", "dateUpdated": "2026-11-10T16:18:06.940Z"}, "containers": {"cna": {"title": "Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header \u2014 incomplete fix of CVE-2026-34835", "problemTypes": [{"descriptions": [{"cweId": "CWE-1286", "lang": "en", "description": "CWE-1286: Improper Validation of Syntactic Correctness of Input", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/rack/rack/security/advisories/GHSA-2j8w-xcrc-x985", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rack/rack/security/advisories/GHSA-2j8w-xcrc-x985"}, {"name": "https://github.com/rack/rack/commit/4380381a56dc52556a436d6d794c8e18dc8b0565", "tags": ["x_refsource_MISC"], "url": "https://github.com/rack/rack/commit/4380381a56dc52556a436d6d794c8e18dc8b0565"}, {"name": "https://github.com/rack/rack/commit/49386f460286b7346c7003b69a839de782cc8a39", "tags": ["x_refsource_MISC"], "url": "https://github.com/rack/rack/commit/49386f460286b7346c7003b69a839de782cc8a39"}, {"name": "https://github.com/rack/rack/releases/tag/v3.1.23", "tags": ["x_refsource_MISC"], "url": "https://github.com/rack/rack/releases/tag/v3.1.23"}, {"name": "https://github.com/rack/rack/releases/tag/v3.2.8", "tags": ["x_refsource_MISC"], "url": "https://github.com/rack/rack/releases/tag/v3.2.8"}], "affected": [{"vendor": "rack", "product": "rack", "versions": [{"version": ">= 3.0, < 3.1.23", "status": "affected"}, {"version": ">= 3.2, < 3.2.8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-09T21:57:46.924Z"}, "descriptions": [{"lang": "en", "value": "Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Request#host_with_port, #base_url, and #url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use these methods for absolute URLs, redirects, or origin-dependent checks can emit attacker-chosen delimiters, enabling redirect manipulation, string-based allowlist bypass, or unescaped markup reflection. Rails overrides these methods and is not expected to be affected. This issue is fixed in versions 3.1.23 and 3.2.8."}], "source": {"advisory": "GHSA-2j8w-xcrc-x985", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-10T16:17:53.102307Z", "id": "CVE-2026-125109", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T16:18:06.940Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-125109", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-10T16:17:53.102307Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T16:18:00.936Z"}}], "cna": {"title": "Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header \u2014 incomplete fix of CVE-2026-34835", "source": {"advisory": "GHSA-2j8w-xcrc-x985", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "rack", "product": "rack", "versions": [{"status": "affected", "version": ">= 3.0, < 3.1.23"}, {"status": "affected", "version": ">= 3.2, < 3.2.8"}]}], "references": [{"url": "https://github.com/rack/rack/security/advisories/GHSA-2j8w-xcrc-x985", "name": "https://github.com/rack/rack/security/advisories/GHSA-2j8w-xcrc-x985", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/rack/rack/commit/4380381a56dc52556a436d6d794c8e18dc8b0565", "name": "https://github.com/rack/rack/commit/4380381a56dc52556a436d6d794c8e18dc8b0565", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rack/rack/commit/49386f460286b7346c7003b69a839de782cc8a39", "name": "https://github.com/rack/rack/commit/49386f460286b7346c7003b69a839de782cc8a39", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rack/rack/releases/tag/v3.1.23", "name": "https://github.com/rack/rack/releases/tag/v3.1.23", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rack/rack/releases/tag/v3.2.8", "name": "https://github.com/rack/rack/releases/tag/v3.2.8", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Request#host_with_port, #base_url, and #url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use these methods for absolute URLs, redirects, or origin-dependent checks can emit attacker-chosen delimiters, enabling redirect manipulation, string-based allowlist bypass, or unescaped markup reflection. Rails overrides these methods and is not expected to be affected. This issue is fixed in versions 3.1.23 and 3.2.8."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1286", "description": "CWE-1286: Improper Validation of Syntactic Correctness of Input"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-09T21:57:46.924Z"}}}, "cveMetadata": {"cveId": "CVE-2026-125109", "state": "PUBLISHED", "dateUpdated": "2026-11-10T16:18:06.940Z", "dateReserved": "2026-11-09T17:45:35.935Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-09T21:57:46.924Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "rack", "vendor": "rack", "versions": [{"status": "affected", "version": ">= 3.0, < 3.1.23"}, {"status": "affected", "version": ">= 3.2, < 3.2.8"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Request#host_with_port, #base_url, and #url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without an independent host allowlist that use these methods for absolute URLs, redirects, or origin-dependent checks can emit attacker-chosen delimiters, enabling redirect manipulation, string-based allowlist bypass, or unescaped markup reflection. Rails overrides these methods and is not expected to be affected. This issue is fixed in versions 3.1.23 and 3.2.8."}], "id": "CVE-2026-125109", "lastModified": "2026-11-12T19:18:09.510", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-125109", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-10T16:17:53.102307Z", "version": "2.0.3"}}]}, "published": "2026-11-09T22:18:42.127", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/rack/rack/commit/4380381a56dc52556a436d6d794c8e18dc8b0565"}, {"source": "security-advisories@github.com", "url": "https://github.com/rack/rack/commit/49386f460286b7346c7003b69a839de782cc8a39"}, {"source": "security-advisories@github.com", "url": "https://github.com/rack/rack/releases/tag/v3.1.23"}, {"source": "security-advisories@github.com", "url": "https://github.com/rack/rack/releases/tag/v3.2.8"}, {"source": "security-advisories@github.com", "url": "https://github.com/rack/rack/security/advisories/GHSA-2j8w-xcrc-x985"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1286"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "rack: Rack: Security bypass and URL manipulation via invalid HTTP host headers", "id": "2570213", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2570213"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-1286", "details": ["A flaw was found in Rack. A remote attacker can exploit this vulnerability by sending HTTP requests with specially crafted host headers containing invalid characters. Because the interface returns unvalidated host data when authority validation fails, applications relying on it to construct URLs may be manipulated into redirecting users to malicious destinations, bypassing security allowlists, or reflecting unescaped content."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-125109", "package_state": [{"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Fix deferred", "package_name": "3scale-amp2/backend-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Not affected", "package_name": "3scale-amp2/system-rhel8", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Not affected", "package_name": "3scale-amp2/system-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:3scale:2.13", "fix_state": "Not affected", "package_name": "3scale-amp2/zync-rhel9", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "pcs", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Not affected", "package_name": "pcs", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "pcs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "pcs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Not affected", "package_name": "rhosp13/openstack-cinder-backup", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Not affected", "package_name": "rhosp13/openstack-cinder-volume", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Not affected", "package_name": "rhosp13/openstack-haproxy", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Not affected", "package_name": "rhosp13/openstack-manila-share", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Not affected", "package_name": "rhosp13/openstack-mariadb", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Not affected", "package_name": "rhosp13/openstack-ovn-northd", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Not affected", "package_name": "rhosp13/openstack-rabbitmq", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Not affected", "package_name": "rhosp13/openstack-redis", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "rhosp-rhel8/openstack-cinder-backup", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "rhosp-rhel8/openstack-cinder-volume", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "rhosp-rhel8/openstack-haproxy", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "rhosp-rhel8/openstack-manila-share", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "rhosp-rhel8/openstack-mariadb", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "rhosp-rhel8/openstack-ovn-northd", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "rhosp-rhel8/openstack-rabbitmq", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "rhosp-rhel8/openstack-redis", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Not affected", "package_name": "rhosp-rhel9/openstack-cinder-backup", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Not affected", "package_name": "rhosp-rhel9/openstack-cinder-volume", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Not affected", "package_name": "rhosp-rhel9/openstack-haproxy", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Not affected", "package_name": "rhosp-rhel9/openstack-manila-share", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Not affected", "package_name": "rhosp-rhel9/openstack-mariadb", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Not affected", "package_name": "rhosp-rhel9/openstack-ovn-northd", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Not affected", "package_name": "rhosp-rhel9/openstack-rabbitmq", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Not affected", "package_name": "rhosp-rhel9/openstack-redis", "product_name": "Red Hat OpenStack Platform 17.1"}], "public_date": "2026-11-09T21:57:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-125109\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-125109\nhttps://github.com/rack/rack/commit/4380381a56dc52556a436d6d794c8e18dc8b0565\nhttps://github.com/rack/rack/commit/49386f460286b7346c7003b69a839de782cc8a39\nhttps://github.com/rack/rack/releases/tag/v3.1.23\nhttps://github.com/rack/rack/releases/tag/v3.2.8\nhttps://github.com/rack/rack/security/advisories/GHSA-2j8w-xcrc-x985"], "statement": "This vulnerability is rated as Moderate severity because successful exploitation requires an application to consume unvalidated authority helpers directly without host restrictions, restricting the blast radius to header-driven URL manipulation or redirection tampering. Standard frameworks such as Ruby on Rails override these helper routines with custom implementations and remain unaffected by default. Furthermore, deployments positioned behind reverse proxies that sanitize or overwrite forwarded routing headers prevent external manipulation of the request authority.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.0,3.1.23)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.2,3.2.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "rack", "source": "cna", "vendor": "rack"}, "product": "rack", "vendor": "rack"}], "created": "2026-11-09T23:30:17.907645+00:00", "updated": "2026-11-09T23:30:18.549221+00:00", "vendors": ["rack", "rack$PRODUCT$rack"]}