Rack’s request parsing incorrectly handles RFC 7239 Forwarded headers by splitting on semicolons before processing quoted‑string values. This allows a single header to be interpreted as multiple Forwarded directives. A malicious value can therefore inject host, proto, for, or by parameters, causing the application to believe it is communicating with a different host or scheme.

The vulnerability affects Rack version 3.0.0.beta1 through 3.1.20 and 3.2.0 through 3.2.5. All later versions, including 3.1.21 and 3.2.6 and beyond, contain the fix. The issue applies to any Ruby web application that uses the Rack interface for request processing.

The CVSS score of 4.8 indicates moderate severity. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation is currently unlikely. Attackers must be able to control or tamper with the Forwarded header sent by an upstream proxy, WAF, or other intermediary. When this condition is met, an attacker can spoof the host or scheme, which may affect downstream routing or logging behaviors, but no further consequences are documented in the advisory.