Search: CVE-2026-32762

A vulnerability in Ruby Rack versions from 3.0.0.beta1 to before 3.1.21 and 3.2.0 to before 3.2.6 allows improper parsing of the RFC 7239 Forwarded header. Rack::Utils.forwarded_values splits on semicolons before handling quoted-string values, but quoted values may legally contain semicolons. This causes a single header value to be misinterpreted as multiple Forwarded directives, potentially enabling an attacker to smuggle host, proto, for, or by parameters through a single header. The issue has been patched in versions 3.1.21 and 3.2.6.