Rack CVE-2026-32762

The CVSS score of 4.8 reflects low to medium severity: the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N indicates remote, unauthenticated attack with high complexity, resulting in low confidentiality and integrity impact with no availability impact. The high complexity factor reflects that successful exploitation requires specific architecture conditions-specifically, an inconsistency between how Rack and an upstream intermediary parse the same Forwarded header. Real-world risk is contingent on deployment topology: applications behind a proxy or WAF that normalizes or validates quoted Forwarded values differently from Rack are at risk, while standalone Rack deployments without trusted upstream proxies face minimal risk. The vulnerability is not a code execution or authentication bypass; rather, it enables request smuggling at the HTTP semantics layer (header injection), which could lead to cache poisoning, host confusion, or protocol downgrade if combined with other logic flaws. No KEV status, public POC, or EPSS data are available; however, the parser differential nature and RFC compliance issue suggest moderate real-world exploitability in shared-hosting or multi-tenant proxy environments. This is a genuine priority for production deployments behind load balancers or WAFs, but not a critical emergency.

An attacker in a position to inject or modify HTTP headers (e.g., via a compromised client, MitM, or in an open proxy environment) crafts a Forwarded header with a quoted-string value containing a semicolon, such as 'for="192.0.2.1; for=attacker.example.com"'. When the request passes through an upstream WAF or proxy that correctly parses the RFC 7239 format and preserves the header intact, it reaches a Rack application. Rack incorrectly splits this single quoted directive into two, interpreting the attacker's injected 'for=attacker.example.com' as a separate Forwarded directive. This causes the application to believe the request originated from attacker.example.com instead of the legitimate upstream proxy, potentially poisoning caches, bypassing IP-based ACLs, or confusing protocol/host detection logic if the application relies on Forwarded headers for routing decisions. No public exploit code is currently available, and no active exploitation has been reported.