{"affected":[{"product":"rack","source":"CNA: GitHub_M","vendor":"rack","versions":[{"status":"affected","version":"< 2.2.25"},{"status":"affected","version":">= 3.0, < 3.1.23"},{"status":"affected","version":">= 3.2, < 3.2.8"}]},{"ecosystem":"rubygems","packageName":"rack","product":"rack","source":"GitHub GHSA-wvg4-6p58-3gh3","vendor":"","versions":[{"status":"affected","version":"< 2.2.25","versionType":"GitHub advisory range"}]},{"ecosystem":"rubygems","packageName":"rack","product":"rack","source":"GitHub GHSA-wvg4-6p58-3gh3","vendor":"","versions":[{"status":"affected","version":">= 3.0, < 3.1.23","versionType":"GitHub advisory range"}]},{"ecosystem":"rubygems","packageName":"rack","product":"rack","source":"GitHub GHSA-wvg4-6p58-3gh3","vendor":"","versions":[{"status":"affected","version":">= 3.2, < 3.2.8","versionType":"GitHub advisory range"}]},{"defaultStatus":"unaffected","ecosystem":"RubyGems","packageName":"rack","product":"rack","source":"OSV GHSA-wvg4-6p58-3gh3","vendor":"","versions":[{"status":"affected","version":"0.1.0","versionType":"RubyGems"},{"status":"affected","version":"0.2.0","versionType":"RubyGems"},{"status":"affected","version":"0.3.0","versionType":"RubyGems"},{"status":"affected","version":"0.4.0","versionType":"RubyGems"},{"status":"affected","version":"0.9.0","versionType":"RubyGems"},{"status":"affected","version":"0.9.1","versionType":"RubyGems"},{"status":"affected","version":"1.0.0","versionType":"RubyGems"},{"status":"affected","version":"1.0.1","versionType":"RubyGems"},{"status":"affected","version":"1.1.0","versionType":"RubyGems"},{"status":"affected","version":"1.1.1","versionType":"RubyGems"},{"status":"affected","version":"1.1.1.pre","versionType":"RubyGems"},{"status":"affected","version":"1.1.2","versionType":"RubyGems"},{"status":"affected","version":"1.1.3","versionType":"RubyGems"},{"status":"affected","version":"1.1.4","versionType":"RubyGems"},{"status":"affected","version":"1.1.5","versionType":"RubyGems"},{"status":"affected","version":"1.1.6","versionType":"RubyGems"},{"status":"affected","version":"1.2.0","versionType":"RubyGems"},{"status":"affected","version":"1.2.1","versionType":"RubyGems"},{"status":"affected","version":"1.2.2","versionType":"RubyGems"},{"status":"affected","version":"1.2.3","versionType":"RubyGems"},{"status":"affected","version":"1.2.4","versionType":"RubyGems"},{"status":"affected","version":"1.2.5","versionType":"RubyGems"},{"status":"affected","version":"1.2.6","versionType":"RubyGems"},{"status":"affected","version":"1.2.7","versionType":"RubyGems"},{"status":"affected","version":"1.2.8","versionType":"RubyGems"},{"status":"affected","version":"1.3.0","versionType":"RubyGems"},{"status":"affected","version":"1.3.0.beta","versionType":"RubyGems"},{"status":"affected","version":"1.3.0.beta2","versionType":"RubyGems"},{"status":"affected","version":"1.3.1","versionType":"RubyGems"},{"status":"affected","version":"1.3.10","versionType":"RubyGems"},{"status":"affected","version":"1.3.2","versionType":"RubyGems"},{"status":"affected","version":"1.3.3","versionType":"RubyGems"},{"status":"affected","version":"1.3.4","versionType":"RubyGems"},{"status":"affected","version":"1.3.5","versionType":"RubyGems"},{"status":"affected","version":"1.3.6","versionType":"RubyGems"},{"status":"affected","version":"1.3.7","versionType":"RubyGems"},{"status":"affected","version":"1.3.8","versionType":"RubyGems"},{"status":"affected","version":"1.3.9","versionType":"RubyGems"},{"status":"affected","version":"1.4.0","versionType":"RubyGems"},{"status":"affected","version":"1.4.1","versionType":"RubyGems"},{"status":"affected","version":"1.4.2","versionType":"RubyGems"},{"status":"affected","version":"1.4.3","versionType":"RubyGems"},{"status":"affected","version":"1.4.4","versionType":"RubyGems"},{"status":"affected","version":"1.4.5","versionType":"RubyGems"},{"status":"affected","version":"1.4.6","versionType":"RubyGems"},{"status":"affected","version":"1.4.7","versionType":"RubyGems"},{"status":"affected","version":"1.5.0","versionType":"RubyGems"},{"status":"affected","version":"1.5.0.beta.1","versionType":"RubyGems"},{"status":"affected","version":"1.5.0.beta.2","versionType":"RubyGems"},{"status":"affected","version":"1.5.1","versionType":"RubyGems"},{"status":"affected","version":"1.5.2","versionType":"RubyGems"},{"status":"affected","version":"1.5.3","versionType":"RubyGems"},{"status":"affected","version":"1.5.4","versionType":"RubyGems"},{"status":"affected","version":"1.5.5","versionType":"RubyGems"},{"status":"affected","version":"1.6.0","versionType":"RubyGems"},{"status":"affected","version":"1.6.0.beta","versionType":"RubyGems"},{"status":"affected","version":"1.6.0.beta2","versionType":"RubyGems"},{"status":"affected","version":"1.6.1","versionType":"RubyGems"},{"status":"affected","version":"1.6.10","versionType":"RubyGems"},{"status":"affected","version":"1.6.11","versionType":"RubyGems"},{"status":"affected","version":"1.6.12","versionType":"RubyGems"},{"status":"affected","version":"1.6.13","versionType":"RubyGems"},{"status":"affected","version":"1.6.2","versionType":"RubyGems"},{"status":"affected","version":"1.6.3","versionType":"RubyGems"},{"status":"affected","version":"1.6.4","versionType":"RubyGems"},{"status":"affected","version":"1.6.5","versionType":"RubyGems"},{"status":"affected","version":"1.6.6","versionType":"RubyGems"},{"status":"affected","version":"1.6.7","versionType":"RubyGems"},{"status":"affected","version":"1.6.8","versionType":"RubyGems"},{"status":"affected","version":"1.6.9","versionType":"RubyGems"},{"status":"affected","version":"2.0.0.alpha","versionType":"RubyGems"},{"status":"affected","version":"2.0.0.rc1","versionType":"RubyGems"},{"status":"affected","version":"2.0.1","versionType":"RubyGems"},{"status":"affected","version":"2.0.2","versionType":"RubyGems"},{"status":"affected","version":"2.0.3","versionType":"RubyGems"},{"status":"affected","version":"2.0.4","versionType":"RubyGems"},{"status":"affected","version":"2.0.5","versionType":"RubyGems"},{"status":"affected","version":"2.0.6","versionType":"RubyGems"},{"status":"affected","version":"2.0.7","versionType":"RubyGems"},{"status":"affected","version":"2.0.8","versionType":"RubyGems"},{"status":"affected","version":"2.0.9","versionType":"RubyGems"},{"status":"affected","version":"2.0.9.1","versionType":"RubyGems"},{"status":"affected","version":"2.0.9.2","versionType":"RubyGems"},{"status":"affected","version":"2.0.9.3","versionType":"RubyGems"},{"status":"affected","version":"2.0.9.4","versionType":"RubyGems"},{"status":"affected","version":"2.1.0","versionType":"RubyGems"},{"status":"affected","version":"2.1.1","versionType":"RubyGems"},{"status":"affected","version":"2.1.2","versionType":"RubyGems"},{"status":"affected","version":"2.1.3","versionType":"RubyGems"},{"status":"affected","version":"2.1.4","versionType":"RubyGems"},{"status":"affected","version":"2.1.4.1","versionType":"RubyGems"},{"status":"affected","version":"2.1.4.2","versionType":"RubyGems"},{"status":"affected","version":"2.1.4.3","versionType":"RubyGems"},{"status":"affected","version":"2.1.4.4","versionType":"RubyGems"},{"status":"affected","version":"2.2.0","versionType":"RubyGems"},{"status":"affected","version":"2.2.1","versionType":"RubyGems"},{"status":"affected","version":"2.2.10","versionType":"RubyGems"},{"status":"affected","version":"2.2.11","versionType":"RubyGems"},{"status":"affected","version":"2.2.12","versionType":"RubyGems"},{"status":"affected","version":"2.2.13","versionType":"RubyGems"},{"status":"affected","version":"2.2.14","versionType":"RubyGems"},{"status":"affected","version":"2.2.15","versionType":"RubyGems"},{"status":"affected","version":"2.2.16","versionType":"RubyGems"},{"status":"affected","version":"2.2.17","versionType":"RubyGems"},{"status":"affected","version":"2.2.18","versionType":"RubyGems"},{"status":"affected","version":"2.2.19","versionType":"RubyGems"},{"status":"affected","version":"2.2.2","versionType":"RubyGems"},{"status":"affected","version":"2.2.20","versionType":"RubyGems"},{"status":"affected","version":"2.2.21","versionType":"RubyGems"},{"status":"affected","version":"2.2.22","versionType":"RubyGems"},{"status":"affected","version":"2.2.23","versionType":"RubyGems"},{"status":"affected","version":"2.2.24","versionType":"RubyGems"},{"status":"affected","version":"2.2.3","versionType":"RubyGems"},{"status":"affected","version":"2.2.3.1","versionType":"RubyGems"},{"status":"affected","version":"2.2.4","versionType":"RubyGems"},{"status":"affected","version":"2.2.5","versionType":"RubyGems"},{"status":"affected","version":"2.2.6","versionType":"RubyGems"},{"status":"affected","version":"2.2.6.1","versionType":"RubyGems"},{"status":"affected","version":"2.2.6.2","versionType":"RubyGems"},{"status":"affected","version":"2.2.6.3","versionType":"RubyGems"},{"status":"affected","version":"2.2.6.4","versionType":"RubyGems"},{"status":"affected","version":"2.2.7","versionType":"RubyGems"},{"status":"affected","version":"2.2.8","versionType":"RubyGems"},{"status":"affected","version":"2.2.8.1","versionType":"RubyGems"},{"status":"affected","version":"2.2.9","versionType":"RubyGems"},{"events":[{"introduced":"0"},{"fixed":"2.2.25"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]},{"defaultStatus":"unaffected","ecosystem":"RubyGems","packageName":"rack","product":"rack","source":"OSV GHSA-wvg4-6p58-3gh3","vendor":"","versions":[{"status":"affected","version":"3.0.0","versionType":"RubyGems"},{"status":"affected","version":"3.0.1","versionType":"RubyGems"},{"status":"affected","version":"3.0.10","versionType":"RubyGems"},{"status":"affected","version":"3.0.11","versionType":"RubyGems"},{"status":"affected","version":"3.0.12","versionType":"RubyGems"},{"status":"affected","version":"3.0.13","versionType":"RubyGems"},{"status":"affected","version":"3.0.14","versionType":"RubyGems"},{"status":"affected","version":"3.0.15","versionType":"RubyGems"},{"status":"affected","version":"3.0.16","versionType":"RubyGems"},{"status":"affected","version":"3.0.17","versionType":"RubyGems"},{"status":"affected","version":"3.0.18","versionType":"RubyGems"},{"status":"affected","version":"3.0.2","versionType":"RubyGems"},{"status":"affected","version":"3.0.3","versionType":"RubyGems"},{"status":"affected","version":"3.0.4","versionType":"RubyGems"},{"status":"affected","version":"3.0.4.1","versionType":"RubyGems"},{"status":"affected","version":"3.0.4.2","versionType":"RubyGems"},{"status":"affected","version":"3.0.5","versionType":"RubyGems"},{"status":"affected","version":"3.0.6","versionType":"RubyGems"},{"status":"affected","version":"3.0.6.1","versionType":"RubyGems"},{"status":"affected","version":"3.0.7","versionType":"RubyGems"},{"status":"affected","version":"3.0.8","versionType":"RubyGems"},{"status":"affected","version":"3.0.9","versionType":"RubyGems"},{"status":"affected","version":"3.0.9.1","versionType":"RubyGems"},{"status":"affected","version":"3.1.0","versionType":"RubyGems"},{"status":"affected","version":"3.1.1","versionType":"RubyGems"},{"status":"affected","version":"3.1.10","versionType":"RubyGems"},{"status":"affected","version":"3.1.11","versionType":"RubyGems"},{"status":"affected","version":"3.1.12","versionType":"RubyGems"},{"status":"affected","version":"3.1.13","versionType":"RubyGems"},{"status":"affected","version":"3.1.14","versionType":"RubyGems"},{"status":"affected","version":"3.1.15","versionType":"RubyGems"},{"status":"affected","version":"3.1.16","versionType":"RubyGems"},{"status":"affected","version":"3.1.17","versionType":"RubyGems"},{"status":"affected","version":"3.1.18","versionType":"RubyGems"},{"status":"affected","version":"3.1.19","versionType":"RubyGems"},{"status":"affected","version":"3.1.2","versionType":"RubyGems"},{"status":"affected","version":"3.1.20","versionType":"RubyGems"},{"status":"affected","version":"3.1.21","versionType":"RubyGems"},{"status":"affected","version":"3.1.22","versionType":"RubyGems"},{"status":"affected","version":"3.1.3","versionType":"RubyGems"},{"status":"affected","version":"3.1.4","versionType":"RubyGems"},{"status":"affected","version":"3.1.5","versionType":"RubyGems"},{"status":"affected","version":"3.1.6","versionType":"RubyGems"},{"status":"affected","version":"3.1.7","versionType":"RubyGems"},{"status":"affected","version":"3.1.8","versionType":"RubyGems"},{"status":"affected","version":"3.1.9","versionType":"RubyGems"},{"events":[{"introduced":"3.0.0"},{"fixed":"3.1.23"}],"status":"unknown","version":"3.0.0","versionType":"ECOSYSTEM"}]},{"defaultStatus":"unaffected","ecosystem":"RubyGems","packageName":"rack","product":"rack","source":"OSV GHSA-wvg4-6p58-3gh3","vendor":"","versions":[{"status":"affected","version":"3.2.0","versionType":"RubyGems"},{"status":"affected","version":"3.2.1","versionType":"RubyGems"},{"status":"affected","version":"3.2.2","versionType":"RubyGems"},{"status":"affected","version":"3.2.3","versionType":"RubyGems"},{"status":"affected","version":"3.2.4","versionType":"RubyGems"},{"status":"affected","version":"3.2.5","versionType":"RubyGems"},{"status":"affected","version":"3.2.6","versionType":"RubyGems"},{"status":"affected","version":"3.2.7","versionType":"RubyGems"},{"events":[{"introduced":"3.2.0"},{"fixed":"3.2.8"}],"status":"unknown","version":"3.2.0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-125110","cwes":["CWE-180"],"description":"Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.clean_path_info normalization but evaluates header_rules against a path that is only URL-decoded. An unauthenticated attacker can request a known file through raw or percent-encoded dot segments and receive it without path-specific security headers such as Content-Disposition or Content-Security-Policy. Applications that do not use path-specific header_rules are not affected. This issue is fixed in versions 2.2.25, 3.1.23, and 3.2.8.","epss":{"date":"2026-11-13","percentile":0.16582,"score":0.00251},"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},{"score":5.3,"severity":"medium","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1794623126839,"publishedAt":1794261640811,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/rack/rack/security/advisories/GHSA-wvg4-6p58-3gh3"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/rack/rack/commit/18a07fe553afb4d8a678d6a948cd6ba1e11e28be"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/rack/rack/commit/9d7f19484ffd5ed5e032678c26ee6eff96d3a0a3"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/rack/rack/commit/e88097ccb88be44d06d47b42daffe04929516ee4"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/rack/rack/commit/18a07fe553afb4d8a678d6a948cd6ba1e11e28be"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/rack/rack/commit/9d7f19484ffd5ed5e032678c26ee6eff96d3a0a3"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/rack/rack/commit/e88097ccb88be44d06d47b42daffe04929516ee4"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/rack/rack/security/advisories/GHSA-wvg4-6p58-3gh3"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/rack/rack/security/advisories/GHSA-wvg4-6p58-3gh3"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-wvg4-6p58-3gh3"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-wvg4-6p58-3gh3"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-wvg4-6p58-3gh3","text":"rack (rubygems): GitHub reports patched versions 2.2.25. Check the advisory for the affected release branch.","url":"https://github.com/rack/rack/security/advisories/GHSA-wvg4-6p58-3gh3"},{"kind":"fix","source":"GitHub GHSA-wvg4-6p58-3gh3","text":"rack (rubygems): GitHub reports patched versions 3.1.23. Check the advisory for the affected release branch.","url":"https://github.com/rack/rack/security/advisories/GHSA-wvg4-6p58-3gh3"},{"kind":"fix","source":"GitHub GHSA-wvg4-6p58-3gh3","text":"rack (rubygems): GitHub reports patched versions 3.2.8. Check the advisory for the affected release branch.","url":"https://github.com/rack/rack/security/advisories/GHSA-wvg4-6p58-3gh3"},{"kind":"fix","source":"OSV GHSA-wvg4-6p58-3gh3","text":"rack (RubyGems): OSV reports a fixed version 2.2.25. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-wvg4-6p58-3gh3"},{"kind":"fix","source":"OSV GHSA-wvg4-6p58-3gh3","text":"rack (RubyGems): OSV reports a fixed version 3.1.23. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-wvg4-6p58-3gh3"},{"kind":"fix","source":"OSV GHSA-wvg4-6p58-3gh3","text":"rack (RubyGems): OSV reports a fixed version 3.2.8. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-wvg4-6p58-3gh3"}],"revision":"5d3199c3ce4eb530ab03a599c9c4a72be52c26121135e92dc58a1ff2e1b006d0","sources":[{"modifiedAt":1794623126839,"name":"CNA: GitHub_M","retrievedAt":1794625724752,"url":"https://www.cve.org/CVERecord?id=CVE-2026-125110"},{"modifiedAt":1794511089510,"name":"NVD","retrievedAt":1794529188551,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125110"},{"modifiedAt":1794262314000,"name":"GitHub Security Advisories","retrievedAt":1794627909564,"url":"https://github.com/rack/rack/security/advisories/GHSA-wvg4-6p58-3gh3"},{"modifiedAt":1794337204397,"name":"OSV / GitHub Security Advisories","retrievedAt":1794625725466,"url":"https://osv.dev/vulnerability/GHSA-wvg4-6p58-3gh3"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794625738906,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-125110"}],"ssvc":{"assessedAt":1794623117811,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch","updatedAt":1794627909564}