Skip to content
OpenAdvisories
High USN-7366-1 3 CVEs

ruby-rack vulnerabilities

Published Mar 24, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

Nhật Thái Đỗ discovered that Rack incorrectly handled certain usernames. A
remote attacker could possibly use this issue to perform CRLF injection.
(CVE-2025-25184)

Phạm Quang Minh discovered that Rack incorrectly handled certain headers. A
remote attacker could possibly use this issue to perform log injection.
(CVE-2025-27111)

Phạm Quang Minh discovered that Rack did not properly handle relative file
paths. A remote attacker could potentially exploit this to include local
files that should have been inaccessible. (CVE-2025-27610)

Fixed packages 6

ReleasePackageFixed in
Ubuntu · 24.04 LTS 24.04:LTS ruby-rack 2.2.7-1ubuntu0.2
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS ruby-rack 1.5.2-3+deb8u3ubuntu1~esm9
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS ruby-rack 1.6.4-3ubuntu0.2+esm7
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS ruby-rack 1.6.4-4ubuntu0.2+esm7
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS ruby-rack 2.0.7-2ubuntu0.1+esm6
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS ruby-rack 2.1.4-5ubuntu1.1+esm1

Vulnerabilities 3

  • High 7.5
    CVE-2025-27610

    Local File Inclusion in Rack::Static

    Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:`…

    rack rack kube-fluentd-operator rack Debian Ubuntu Wolfi RubyGems
  • Medium 6.9
    CVE-2025-27111

    Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

    Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in lo…

    rack rack rack ruby-rack Debian Ubuntu Wolfi RubyGems
  • Medium 5.7
    CVE-2025-25184

    Possible Log Injection in Rack::CommonLogger

    Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept d…

    rack rack kube-fluentd-operator rack Debian Ubuntu Wolfi RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2025-25184
  • report
    https://ubuntu.com/security/CVE-2025-27111
  • report
    https://ubuntu.com/security/CVE-2025-27610