Rack, a modular Ruby web server interface, interprets the RFC 7239 Forwarded header by splitting on semicolons before processing quoted-string values. Quoted values may legitimately contain semicolons, so a single header can be read as multiple Forwarded directives instead of a single quoted value. This parsing quirk allows an attacker to smuggle host, proto, for, or by parameters into one header, causing Rack to believe the request originates from a forged host or scheme. The result is host and scheme spoofing, which can mislead applications that rely on these header values for authentication or routing.

The vulnerable product is Rack. Versions from 3.0.0.beta1 up to 3.1.20, and from 3.2.0 up to 3.2.5, are affected. The issue is fixed in Rack 3.1.21 and 3.2.6.

The vulnerability has a CVSS score of 4.8, indicating moderate severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote HTTP request that includes a malicious Forwarded header to the Rack application. The attacker only needs to send a request that incorporates the forged header. Successful exploitation results in host or scheme spoofing, potentially undermining any logic that depends on these forwarded values.