PT-2025-7051 · Rack+6 · Rack+6

Hexsave · Published 2025-02-12 · Updated 2026-03-13 · CVE-2025-25184

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.11, 3.0.12, and 3.1.11

Description Rack provides an interface for developing web applications in Ruby. The issue occurs when a server intentionally or unintentionally allows a user creation with the username containing CRLF and white space characters, or the server just wants to log every login attempt. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the logfile. Attackers can break log formats or insert fraudulent entries, potentially obscuring real activity or injecting malicious data into log files.

Recommendations

• Update to version 2.2.11 or later for Rack version 2.2.x
• Update to version 3.0.12 or later for Rack version 3.0.x
• Update to version 3.1.11 or later for Rack version 3.1.x As a temporary workaround, consider restricting the use of Rack::CommonLogger until a patch is available. Avoid using the env['REMOTE USER'] variable in the affected API endpoint until the issue is resolved.

Exploit

Fix

DoS

Weakness Enumeration

CWE-117

CWE-93

Related Identifiers

BDU:2025-07021

CVE-2025-25184

DLA-4090-1

DSA-5886-1

GHSA-7G2V-JJ9Q-G3RG

INFSA-2025_7085

MGASA-2025-0311

OESA-2025-1299

OPENSUSE-SU-2025:14811-1

OPENSUSE-SU-2025:14875-1

OPENSUSE-SU-2025_0858-1

OPENSUSE-SU-2025_0874-1

OPENSUSE-SU-2026:10286-1

OPENSUSE-SU-2026:10358-1

RHSA-2025:7085

RHSA-2025_7085

SUSE-SU-2025:0858-1

SUSE-SU-2025:0874-1

SUSE-SU-2025_0874-1

USN-7366-1

USN-7366-2

Affected Products

Debian

Linuxmint

Rack

Red Hat

Red Os

Suse

Ubuntu

References · 86

• 🔥 https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25184.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-25184.yml · Exploit
• https://github.com/rack/rack/commit/074ae244430cda05c27ca91cda699709cfb3ad8e · Patch
• https://ubuntu.com/security/CVE-2025-27610 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7366-2 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7366-2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25184 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-27610 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:14875-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10358-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-25184 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1299 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:0858-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-25184 · Vendor Advisory