Rack, a modular Ruby web server interface, had a flaw in versions 3.0 through 3.1.22 and 3.2.0 through 3.2.7 where the request methods host_with_port, base_url, and url could return the raw, attacker‑controlled value of the Host header or related proxy headers. This allowed an attacker to insert arbitrary delimiters and malformed authorities, enabling redirect manipulation, bypass of string‑based allowlists, and unescaped markup reflection. The weakness is identified as CWE‑1286.

The vulnerability affects Ruby Rack releases 3.0.x, 3.1.0–3.1.22 and 3.2.0–3.2.7. Rails provides its own overrides that are not expected to be impacted.

The CVSS score of 4.8 indicates a moderate impact. Exploitation requires an attacker to send a crafted HTTP request with a malicious Host, X‑Forwarded‑Host, or Forwarded: host header. If an application uses the affected Rack methods without an independent host allowlist, the attacker can redirect users or inject markup via reflected URLs. The flaw is not listed in the CISA KEV catalog and no EPSS score is available at this time.