Threats tagged 'ghsa-7g2v-jj9q-g3rg'

CVE-2025-25184 is a log injection vulnerability in Rack::CommonLogger where specially crafted usernames containing newline characters can manipulate log entries. This occurs when usernames with CRLF characters are logged, allowing attackers to break log formats or insert fraudulent entries. The issue affects certain versions of the Rack Ruby gem and has been fixed in versions 2.2.11, 3.0.12, and 3.1.10.