A path normalization mismatch in Rack::Static header_rules allows bypassing security headers for protected static files. Requests with dot segments can access files without the intended security headers applied, potentially exposing files without Content-Disposition or restrictive Content-Security-Policy headers.