Description
Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection. This vulnerability is fixed in 2.2.12, 3.0.13, and 3.1.11.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rack | rack | < 2.2.12, >= 3.0, < 3.0.13, >= 3.1, < 3.1.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-rack | 3.1.12-1 | — |
| Debian 13 | ruby-rack | 3.1.12-1 | — |
| Debian 12 | ruby-rack | 2.2.13-1~deb12u1 | DSA-5886-1 |
| Debian 11 | ruby-rack | 2.1.4-3+deb11u3 | DLA-4090-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | ruby-rack | 3.1.16-0.1 | — |
| Ubuntu 25.10 | ruby-rack | 3.1.16-0.1 | — |
| Ubuntu 25.04 | ruby-rack | 2.2.7-1.1ubuntu0.25.04.2 | USN-7366-2 |
| Ubuntu 24.04 LTS | ruby-rack | 2.2.7-1ubuntu0.2 | USN-7366-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | ruby-rack | 2.1.4-5ubuntu1.1+esm1 | USN-7366-1 |
| Ubuntu Pro 20.04 LTS | ruby-rack | 2.0.7-2ubuntu0.1+esm6 | USN-7366-1 |
| Ubuntu Pro 18.04 LTS | ruby-rack | 1.6.4-4ubuntu0.2+esm7 | USN-7366-1 |
| Ubuntu Pro 16.04 LTS | ruby-rack | 1.6.4-3ubuntu0.2+esm7 | USN-7366-1 |
| Ubuntu Pro 14.04 LTS | ruby-rack | 1.5.2-3+deb8u3ubuntu1~esm9 | USN-7366-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | rubygem-rack | 2.0.8-150000.3.26.1 | SUSE-SU-2025:0874-1 |
| SLES 15 SP5 | rubygem-rack | 2.0.8-150000.3.26.1 | SUSE-SU-2025:0874-1 |
| SLES 15 SP4 | rubygem-rack | 2.0.8-150000.3.26.1 | SUSE-SU-2025:0874-1 |
| SLES 15 SP3 | rubygem-rack | 2.0.8-150000.3.26.1 | SUSE-SU-2025:0874-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rubygem-rack | 3.1.12-1.1 | openSUSE-SU-2026:10358-1, openSUSE-SU-2025:14875-1 |
| openSUSE Tumbleweed | rubygem-rack-2.2 | 2.2.12-1.1 | openSUSE-SU-2026:10286-1, openSUSE-SU-2025:14859-1 |
| openSUSE Leap 15.6 | rubygem-rack | 2.0.8-150000.3.26.1 | SUSE-SU-2025:0874-1 |
| openSUSE Leap 15.6 | rubygem-rack-1_6 | 1.6.8-150000.3.6.1 | SUSE-SU-2025:1492-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | pcs +1 | 0.9.169-3.amzn2.3.0.4 | ALAS2-2025-2822 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | logstash-8-with-output-opensearch | 8.17.3-r1 | — |
| Wolfi rolling | ruby3.2-rack-2.2 +3 | 2.2.22-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | rack | < 2.2.12 | 2.2.12 | GHSA-8cgq-6mh2-7j6v |
| RubyGems | rack | >= 3.0, < 3.0.13 | 3.0.13 | GHSA-8cgq-6mh2-7j6v |
| RubyGems | rack | >= 3.1, < 3.1.11 | 3.1.11 | GHSA-8cgq-6mh2-7j6v |
Advisories 12
- USN-7366-1 ruby-rack vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- openSUSE-SU-2026:10286-1 ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:1492-1 Security update for rubygem-rack-1_6 SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2026:10358-1 ruby4.0-rubygem-rack-3.1.18-1.3 on GA media SUSE / openSUSE Security Updates · Mar 14, 2026
- DSA-5886-1 ruby-rack - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4090-1 ruby-rack - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2025:14859-1 ruby3.4-rubygem-rack-2.2-2.2.12-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0874-1 Security update for rubygem-rack SUSE / openSUSE Security Updates · Feb 4, 2026
- USN-7366-2 ruby-rack vulnerabilities Ubuntu Security Notices (USN) · Feb 4, 2026
- WID-SEC-2025-0580 IBM License Metric Tool: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 21, 2025
- openSUSE-SU-2025:14875-1 ruby3.4-rubygem-rack-3.1.12-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- ALAS2-2025-2822 Moderate: pcs security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 16, 2025