Threats tagged 'ghsa-2j8w-xcrc-x985'

A vulnerability in Rack's Request handling causes methods like host_with_port, base_url, and url to return raw, unvalidated Host header values when the authority string is invalid. This can lead to attacker-controlled characters being embedded in URLs generated by the application, potentially enabling URL manipulation and bypass of string-based URL checks. The issue affects Rack versions 3.0.0 up to but not including 3.1.23 and 3.2.0 up to but not including 3.2.8. A fix is available in versions 3.1.23 and 3.2.8.