CVE-2025-27111

Katalog CVE

CVSS 7.5 · High EPSS 0,75%

Kerentanan Improper Neutralization of CRLF Sequences ('CRLF Injection') pada rack. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection. This vulnerability is fixed in 2.2.12, 3.0.13, and 3.1.11.

Rincian

Terbit di NVD

4 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-117: Improper Output Neutralization for Logs

EPSS (30 hari)

0,75% peluang dieksploitasi; lebih tinggi dari 53,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rack/rack/security/advisories/GHSA-8cgq-6mh2-7j6v mitigasi · advisory vendor
• https://github.com/rack/rack/commit/803aa221e8302719715e224f4476e438f2531a53 patch
• https://github.com/rack/rack/commit/aeac570bb8080ca7b53b7f2e2f67498be7ebd30b patch
• https://github.com/rack/rack/commit/b13bc6bfc7506aca3478dc5ac1c2ec6fc53f82a3 patch
• https://lists.debian.org/debian-lts-announce/2025/03/msg00016.html