CVE catalog
CVE-2026-32762
Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21 and 3.2.0 to before 3.2.6, Rack::Utils.forwarded_values parses the RFC 7239 Forwarded header by splitting on sem
- Severity
- Medium · CVSS 4.8
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.18% · Oct 25, 2026
Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21 and 3.2.0 to before 3.2.6, Rack::Utils.forwarded_values parses the RFC 7239 Forwarded header by splitting on semicolons before handling quoted-string values. Because quoted values may legally contain semicolons, a header can be interpreted by Rack as multiple Forwarded directives rather than as a single quoted for value. In deployments where an upstream proxy, WAF, or intermediary validates or preserves quoted Forwarded values differently, this discrepancy can allow an attacker to smuggle host, proto, for, or by parameters through a single header value. This issue has been patched in versions 3.1.21 and 3.2.6.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | ruby-rack | sid | 3.2.7-1 | fixed |
| Debian | ruby-rack | forky | 3.2.7-1 | fixed |
| Debian | ruby-rack | trixie | 3.1.20-0+deb13u1 | vulnerable |
| Debian | ruby-rack | trixie-security | 3.1.20-0+deb13u2 | fixed |
| Debian | ruby-rack | bookworm | 2.2.22-0+deb12u1 | not affected |
| Debian | ruby-rack | bookworm-security | 2.2.22-0+deb12u2 | not affected |
| Cpe | ruby-rack | Not reported | 2.2.7-1ubuntu0.7 | fixed |
| Cpe | ruby-rack | Not reported | Not reported | vulnerable |
| Cpe | rack | Not reported | 3.1.21 | fixed |
| Cpe | rack | Not reported | 3.2.6 | fixed |
| Ubuntu | ruby-rack | 25.10 | 2.2.7-1.1 | vulnerable |
| Ubuntu | ruby-rack | 25.10 | 3.1.16-0.1 | vulnerable |
| Ubuntu | ruby-rack | 25.10 | 3.1.16-0.1ubuntu0.1 | vulnerable |
| Ubuntu | ruby-rack | 25.10 | 3.1.16-0.1ubuntu0.2 | vulnerable |
| Ubuntu | ruby-rack | 25.10 | 3.1.16-0.1ubuntu0.3 | fixed |
| Ubuntu | ruby-rack | 26.04 | 3.1.16-0.1 | vulnerable |
| Ubuntu | ruby-rack | 26.04 | 3.1.18-1 | vulnerable |
| Ubuntu | ruby-rack | 26.04 | 3.1.18-1build1 | vulnerable |
| Ubuntu | ruby-rack | 26.04 | 3.2.4-1ubuntu1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | ruby-rack | source | sid | 3.2.6-2 | not yet assigned | Not reported | Not reported |
| Debian | ruby-rack | source | forky | 3.2.6-2 | not yet assigned | Not reported | Not reported |
| Debian | ruby-rack | source | trixie | 3.1.20-0+deb13u2 | not yet assigned | Not reported | Not reported |
| Debian | ruby-rack | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Cpe | ruby-rack | cpe | Not reported | 2.2.7-1ubuntu0.7 | Not reported | Not reported | Not reported |
| Cpe | rack | cpe | Not reported | 3.1.21 | Not reported | Not reported | Not reported |
| Cpe | rack | cpe | Not reported | 3.2.6 | Not reported | Not reported | Not reported |
| Ubuntu | ruby-rack | deb | 25.10 | 3.1.16-0.1ubuntu0.3 | Not reported | UBUNTU-CVE-2026-32762 | Not reported |
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [ruby-rack]Affected
Details (5)
3.1.20-0+deb13u1· all · trixieAffected · Fixed:
3.1.20-0+deb13u2nvd · ruby-rack · debian · 13
3.1.20-0+deb13u1· all · trixieAffected · Fixed:
3.1.20-0+deb13u2nvd · ruby-rack · debian · 13
3.1.20-0+deb13u1· all · trixie-securityAffected · Fixed:
3.1.20-0+deb13u2nvd · ruby-rack · debian · 13
3.1.20-0+deb13u1· all · trixie-security · Historical versionAffected · Fixed:
3.1.20-0+deb13u2nvd · ruby-rack · debian · 13
3.1.20-0+deb13u2· all · trixie-securityFixed · Fixed:
3.1.20-0+deb13u2nvd · ruby-rack · debian · 13
[Debian 12 (Bookworm)]
- [ruby-rack]Not affected
Details (4)
2.2.22-0+deb12u1· all · bookwormNot affected
nvd · ruby-rack · debian · bookworm
2.2.22-0+deb12u1· all · bookwormNot affected
nvd · ruby-rack · debian · bookworm
2.2.22-0+deb12u2· all · bookworm-securityNot affected
nvd · ruby-rack · debian · bookworm
2.2.22-0+deb12u2· all · bookworm-securityNot affected
nvd · ruby-rack · debian · bookworm
Observed:
References
- [https://ftp.suse.com/pub/projects/security/]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-32762]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-32762]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-32762]
- [https://security-tracker.debian.org/tracker/CVE-2026-32762]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32762.json]
- [https://ubuntu.com/security/notices/USN-8182-1]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]