Description
Versions of the package sinatra from 0.0.0 are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the X-Forwarded-Host (XFH) header. When making a request to a method with redirect applied, it is possible to trigger an Open Redirect Attack by inserting an arbitrary address into this header. If used for caching purposes, such as with servers like Nginx, or as a reverse proxy, without handling the X-Forwarded-Host header, attackers can potentially exploit Cache Poisoning or Routing-based SSRF.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | sinatra | 0.0.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-sinatra | 4.1.1-2 | — |
| Debian 13 | ruby-sinatra | 4.1.1-2 | — |
| Debian 12 | ruby-sinatra | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | ruby-sinatra | No fix yet | — |
| Ubuntu 22.04 LTS | ruby-sinatra | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | ruby-sinatra | No fix yet | — |
| Ubuntu Pro 18.04 LTS | ruby-sinatra | No fix yet | — |
| Ubuntu Pro 16.04 LTS | ruby-sinatra | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | pcs +1 | 0.10.18-2.el8_10.3 | RHSA-2024:10987 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | pcs +1 | 0.10.18-2.el8_10.3.alma.1 | ALSA-2024:10987 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | pcs | 0.10.18-2.el8_10.3 | RLSA-2024:10987 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | pcs +1 | 0.9.169-3.amzn2.3.0.5 | ALAS2-2025-2853 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | pcs +1 | 0.10.18-2.0.1.el8_10.3 | ELSA-2024-10987 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | gitlab-cng-18.2 | No fix yet | — |
| Wolfi rolling | logstash-8-with-output-opensearch | 8.16.0-r2 | — |
| Wolfi rolling | ruby3.2-sinatra +1 | 4.1.0-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | sinatra | < 4.1.0 | 4.1.0 | GHSA-hxx2-7vcw-mqr3 |
Advisories 5
- ALSA-2024:10987 Moderate: pcs security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:10987 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- RLSA-2024:10987 Moderate: pcs security update Rocky Linux Security Advisories · Feb 4, 2026
- ALAS2-2025-2853 Moderate: pcs security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 13, 2025
- ELSA-2024-10987 Moderate: pcs security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Dec 13, 2024
References
- https://security.snyk.io/vuln/SNYK-RUBY-SINATRA-6483832
- https://github.com/sinatra/sinatra/blob/b626e2d82c23b4fde0b51782fd32ca27ccde1d1a/lib/sinatra/base.rb%23L319
- https://github.com/sinatra/sinatra/blob/b626e2d82c23b4fde0b51782fd32ca27ccde1d1a/lib/sinatra/base.rb%23L323C1-L343C17
- https://github.com/sinatra/sinatra/pull/2010