CVE-2025-27111

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.12 Rack versions prior to 3.0.13 Rack versions prior to 3.1.11

Description The issue concerns the Rack::Sendfile middleware, which logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences, such as newline characters, into the header, resulting in log injection.

Recommendations For versions prior to 2.2.12, update to version 2.2.12 or later. For versions prior to 3.0.13, update to version 3.0.13 or later. For versions prior to 3.1.11, update to version 3.1.11 or later.