Skip to content
Fencer Vulns
medium 5.8

CVE-2025-61780 json

Rack has Possible Information Disclosure Vulnerability

published 2025-10-10 12 mo ago modified 2026-10-19 20 d ago also EUVD-2025-33749 , GHSA-r657-rxjc-j557

cvss
5.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, a possible information disclosure vulnerability existed in `Rack::Sendfile` when running behind a proxy that supports `x-sendfile` headers (such as Nginx). Specially crafted headers could cause `Rack::Sendfile` to miscommunicate with the proxy and trigger unintended internal requests, potentially bypassing proxy-level access restrictions. When `Rack::Sendfile` received untrusted `x-sendfile-type` or `x-accel-mapping` headers from a client, it would interpret them as proxy configuration directives. This could cause the middleware to send a "redirect" response to the proxy, prompting it to reissue a new internal request that was not subject to the proxy's access controls. An attacker could exploit this by setting a crafted `x-sendfile-type: x-accel-redirect` header, setting a crafted `x-accel-mapping` header, and requesting a path that qualifies for proxy-based acceleration. Attackers could bypass proxy-enforced restrictions and access internal endpoints intended to be protected (such as administrative pages). The vulnerability did not allow arbitrary file reads but could expose sensitive application routes. This issue only affected systems meeting all of the following conditions: The application used `Rack::Sendfile` with a proxy that supports `x-accel-redirect` (e.g., Nginx); the proxy did **not** always set or remove the `x-sendfile-type` and `x-accel-mapping` headers; and the application exposed an endpoint that returned a body responding to `.to_path`. Users should upgrade to Rack versions 2.2.20, 3.1.18, or 3.2.3, which require explicit configuration to enable `x-accel-redirect`. Alternatively, configure the proxy to always set or strip the header, or in Rails applications, disable sendfile completely.

Patch / fix

  • rubygems rack 2.2.20, 3.1.18, 3.2.3
  • rack rack 2.2.20, 3.1.18, 3.2.3
  • rack_project rack 2.2.20, 3.1.18, 3.2.3
  • ruby-rack Debian 12 2.2.20-0+deb12u1
  • ruby-rack Debian 13 3.1.18-1~deb13u1
  • ruby-rack Debian 14 3.1.18-1

debian advisories DEBIAN-CVE-2025-61780

  • ruby-rack Ubuntu 22.04 LTS 2.1.4-5ubuntu1.2
  • ruby-rack Ubuntu 24.04 LTS 2.2.7-1ubuntu0.5
  • ruby-rack Ubuntu 25.10 3.1.16-0.1ubuntu0.1
  • ruby-rack Ubuntu Pro 16.04 LTS 1.6.4-3ubuntu0.2+esm9
  • ruby-rack Ubuntu Pro 18.04 LTS 1.6.4-4ubuntu0.2+esm9
  • ruby-rack Ubuntu Pro 20.04 LTS 2.0.7-2ubuntu0.1+esm8

ubuntu advisories UBUNTU-CVE-2025-61780

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rubygem-rack SLE High Availability Extension 15 SP7, SLE High Availability Extension 15 SP6, SLE High Availability Extension 15 SP5 +3 more 2.2.20-150000.3.34.1

suse advisories SUSE-SU-2025:4273-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-61780 updated cvss 5.8

rubygem-rack: Improper handling of headers in `Rack::Sendfile` may allow proxy bypass

  • Red Hat OpenShift Service Mesh 2 openshift-service-mesh/pilot-rhel8, openshift-service-mesh/grafana-rhel8, openshift-service-mesh/proxyv2-rhel9, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/ratelimit-rhel8, openshift-service-mesh/istio-rhel8-operator, +2 more Red Hat 3scale API Management Platform 2 3scale-amp21/zync, 3scale-amp22/zync, 3scale-amp24/zync, 3scale-amp25/zync, 3scale-amp26/zync, 3scale-amp2/zync-rhel7, +2 more
    affected: workaround, no fix available “No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.”
  • Red Hat Enterprise Linux 7 pcs, pcs-snmp, python-clufter Red Hat Enterprise Linux 8 pcs, pcs-snmp
    affected: workaround, no fix planned “No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.”
  • Red Hat Enterprise Linux 9 pcs, pcs-snmp Red Hat Enterprise Linux 10 pcs
    affected: workaround, no fix available “No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.”
  • Red Hat OpenStack Platform 13 (Queens) rhosp13/openstack-redis, rhosp13/openstack-haproxy, rhosp13/openstack-mariadb, rhosp13/openstack-rabbitmq, rhosp13/openstack-ovn-northd, rhosp13/openstack-manila-share, +2 more
    affected: workaround, no fix planned “No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.”
  • Red Hat Satellite 6 rubygem-rack
    affected: workaround, no fix available “No mitigation is currently available that meets Red Hat Product Security's standards for usability, deployment, applicability, or stability.”
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/vector-rhel9, openshift-logging/fluentd-rhel8, openshift-logging/fluentd-rhel9, openshift-logging/eventrouter-rhel9, openshift-logging/logging-view-plugin-rhel9, openshift-logging/cluster-logging-rhel9-operator, +2 more Red Hat Enterprise Linux 6 ruby, ruby-ri, ruby-irb, ruby-libs, ruby-rdoc, ruby-tcltk Red Hat Enterprise Linux 7 ruby, ruby-irb, rubygems, ruby-libs, ruby-tcltk, rubygem-json, +6 more Red Hat Enterprise Linux 8 ruby, ruby-irb, rubygems, ruby-libs, rubygem-pg, rubygem-irb, +25 more Red Hat Enterprise Linux 9 ruby, rubygems, ruby-libs, rubygem-irb, rubygem-rbs, rubygem-rss, +13 more Red Hat Enterprise Linux 10 ruby
    +1 more products
    Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
12 mo ago

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
GitHub 3.1 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem package affected fixed in
rubygems rack
<2.2.20
>=3.0, <3.1.18
>=3.2, <3.2.3
2.2.20
3.1.18
3.2.3

Affected products

  • rack rack

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-441 Unintended Proxy or Intermediary
  • CWE-913 Improper Control of Dynamically-Managed Code Resources

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.