Rack::Static evaluated header_rules against the raw URL‑encoded PATH_INFO while serving the file from the decoded path. This mismatch allows a request for an encoded variant of a static resource to bypass the security‑relevant headers that the header_rules are meant to apply, potentially exposing the server to attacks that rely on those headers such as click‑jacking or MIME‑type sniffing. The flaw is a form of code path error that could undermine the intended integrity controls on static content.

The vulnerability affects installations of Rack using any version earlier than 2.2.23, 3.1.21, or 3.2.6. Deployments that rely on Rack::Static to add security headers to static content are impacted.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit it by crafting an external HTTP request with an URL‑encoded path to a static file; the request is processed against the encoded path for header matching but the decoded path is served without the intended headers. No payload is required beyond normal URL encoding.