Description
agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | passenger | 5.0.22-1 | — |
| Debian 13 | passenger | 5.0.22-1 | — |
| Debian 12 | passenger | 5.0.22-1 | — |
| Debian 8 | ruby-passenger | 4.0.53-1+deb8u1 | DLA-1399-1 |
| Debian 6.0 | passenger | 2.2.11debian-2+deb6u1 | DLA-394-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | rubygem-passenger | 5.0.18-6.1 | SUSE-SU-2015:2337-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE WebYast 1.3 | rubygem-passenger | 3.0.14-0.14.1 | SUSE-SU-2016:0042-1 |
| SUSE Studio Onsite 1.3 | rubygem-passenger | 3.0.14-0.14.1 | SUSE-SU-2016:0042-1 |
| SUSE Lifecycle Management Server 1.3 | rubygem-passenger | 3.0.14-0.14.1 | SUSE-SU-2016:0042-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | passenger | < 4.0.60 | 4.0.60 | GHSA-fxwv-953p-7qpf |
| RubyGems | passenger | >= 5.0.0, < 5.0.22 | 5.0.22 | GHSA-fxwv-953p-7qpf |
Advisories 4
- DLA-394-1 passenger - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1399-1 ruby-passenger - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2016:0042-1 Security update for rubygem-passenger SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:2337-1 Security update for rubygem-passenger SUSE / openSUSE Security Updates · Feb 4, 2026
References
- SUSE-SU-2015:2337 vendor-advisory
- https://github.com/phusion/passenger/commit/ddb8ecc4ebf260e4967f57f271d4f5761abeac3e
- https://blog.phusion.nl/2015/12/07/cve-2015-7519/
- https://puppet.com/security/cve/passenger-dec-2015-security-fixes
- [oss-security] 20151207 injecting environment variables into Phusion Passenger (CVE-2015-7519) mailing-list
- https://bugzilla.suse.com/show_bug.cgi?id=956281
- [oss-security] 20151207 CVE-2015-7519: Phusion Passenger Header overwriting issue mailing-list
- [debian-lts-announce] 20180627 [SECURITY] [DLA 1399-1] ruby-passenger security update mailing-list