CVE-2025-27111
Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection. This vulnerability is fixed in 2.2.12, 3.0.13, and 3.1.11.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.74%
- CWE
- CWE-93, CWE-117
- Published
- 2025-03-04
- Last modified
- 2026-03-13
Affected products
- rack rack
- rack rack
- rack rack
Weakness type
Related vulnerabilities
- CVE-2026-48019 — CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay
- CVE-2026-75925 — IXON VPN Client CRLF Injection
- CVE-2026-84962 — Authenticated KMS request forgery via CRLF injection in GCP key identifier strings
- CVE-2026-84379 — HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers
- CVE-2026-84372 — Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
- CVE-2026-82854 — Nodemailer before 8.0.3 SMTP Command Injection via envelope.size
- CVE-2026-82853 — Nodemailer before 8.0.5 SMTP Command Injection via CRLF
- CVE-2026-82661 — Nodemailer CRLF Injection via List-* Header Comments