Rack::Static evaluates header_rules against the raw URL‑encoded PATH_INFO, while the underlying file‑serving path is decoded before the file is served. This mismatch allows an attacker to request a URL‑encoded variant of a static path and receive the file without the security headers that the header_rules are intended to add. The result is a bypass of the desired response headers for static content.

The vulnerability affects the Rack framework, specifically Rack::Static in versions earlier than 2.2.23, 3.1.21, and 3.2.6. Installing any of the patched releases mitigates the issue.

The CVSS score is 5.3, indicating moderate severity. The flaw is not listed in the CISA KEV catalog and EPSS data is not available. The likely attack vector is a simple HTTP request with a URL‑encoded path; exploitation requires only network access to the target and no special prerequisites. The impact is confined to the loss of the intended security headers, without providing remote code execution or denial of service.