CVE-2025-61780: Information Disclosure in Rack

The core of this vulnerability lies in Rack's handling of x-sendfile-type and x-accel-mapping headers. When these headers, typically used for proxy acceleration, are received from an untrusted source (e.g., a client), Rack incorrectly interprets them as proxy configuration directives. This misinterpretation allows an attacker to manipulate Rack's behavior, causing it to send redirect responses to internal resources that would normally be protected by the proxy. The potential impact includes unauthorized access to sensitive data or internal services that are not directly exposed to the internet. While not a direct remote code execution (RCE) vulnerability, the ability to bypass proxy restrictions can significantly expand an attacker's reach within a network.

1. Reserved2025-09-30
2. Published2025-10-10
3. Modified2026-02-04
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-61780 is to upgrade to Rack version 2.2.20 or later, which includes the fix for this information disclosure vulnerability. If upgrading is not immediately feasible, consider implementing stricter input validation on the proxy server to sanitize or reject potentially malicious x-sendfile headers. Web application firewalls (WAFs) configured to inspect and filter HTTP headers can also provide a layer of defense. Monitor proxy access logs for unusual redirect patterns or requests to internal resources. After upgrading, confirm the fix by sending a crafted x-sendfile header and verifying that Rack no longer attempts to send an internal redirect.