https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T23:06:47.611644+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2025-27111 CVE-2025-27111 — Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection 2026-09-29T23:06:47.613805+00:00

Affected: rack

Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection. This vulnerability is fixed in 2.2.12, 3.0.13, and 3.1.11.

 https://vulnerability.circl.lu/vuln/ghsa-8cgq-6mh2-7j6v GHSA-8cgq-6mh2-7j6v — Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection 2026-09-29T23:06:47.613910+00:00

Affected: RubyGems: rack

## Summary

`Rack::Sendfile` can be exploited by crafting input that includes newline characters to manipulate log entries.

## Details

The `Rack::Sendfile` middleware logs unsanitized header values from the `X-Sendfile-Type` header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection.

## Impact

This vulnerability can distort log files, obscure attack traces, and complicate security auditing.

## Mitigation

- Update to the latest version of Rack, or - Remove usage of `Rack::Sendfile`.