Read the docs
TI-2025-18853 Aliases CVE-2025-25184GHSA-7g2v-jj9q-g3rg

Possible Log Injection in Rack::CommonLogger

Priority LOW 28CWE-117Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 3 fixed, 6 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. When a user provides the authorization credentials via Rack::Auth::Basic, if success, the username will be put in env['REMOTE_USER'] and later be used by Rack::CommonLogger for logging purposes. The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the logfile. Attackers can break log formats or insert fraudulent entries, potentially obscuring real activity or injecting malicious data into log files. Versions 2.2.11, 3.0.12, and 3.1.10 contain a fix.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01185 68th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial rack (rack): 2.2.11, 3.0.12, 3.1.10rack (RubyGems): 2.2.11, 3.0.12, 3.1.10Red Hat: 2 advisoriesRed Hat: 3 fixed, 6 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rackrackbefore 2.2.11; 3.0 to before 3.0.12; 3.1 to before 3.1.102.2.11, 3.0.12, 3.1.10Patch availableCNA
—rack (RubyGems)before 2.2.112.2.11Patch availableGHSA-7g2v-jj9q-g3rg
—rack (RubyGems)3.0 to before 3.0.123.0.12Patch availableGHSA-7g2v-jj9q-g3rg
—rack (RubyGems)3.1 to before 3.1.103.1.10Patch availableGHSA-7g2v-jj9q-g3rg
  • rack Vendorrack Affected before 2.2.11; 3.0 to before 3.0.12; 3.1 to before 3.1.10 Fixed in 2.2.11, 3.0.12, 3.1.10 Patch available CNA
  • rack (RubyGems) Vendor— Affected before 2.2.11 Fixed in 2.2.11 Patch available GHSA-7g2v-jj9q-g3rg
  • rack (RubyGems) Vendor— Affected 3.0 to before 3.0.12 Fixed in 3.0.12 Patch available GHSA-7g2v-jj9q-g3rg
  • rack (RubyGems) Vendor— Affected 3.1 to before 3.1.10 Fixed in 3.1.10 Patch available GHSA-7g2v-jj9q-g3rg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*before 2.2.11; 3.0.0 to before 3.0.12; 3.1.0 to before 3.1.10Vulnerablerack
  • cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:* Versions before 2.2.11; 3.0.0 to before 3.0.12; 3.1.0 to before 3.1.10 Vulnerable ·rack

Remediation

  • Fix · CNA rack (rack) Fixed in 2.2.11, 3.0.12, 3.1.10
  • Fix · GHSA-7g2v-jj9q-g3rg rack (RubyGems) Fixed in 2.2.11 Advisory →
  • Fix · GHSA-7g2v-jj9q-g3rg rack (RubyGems) Fixed in 3.0.12 Advisory →
  • Fix · GHSA-7g2v-jj9q-g3rg rack (RubyGems) Fixed in 3.1.10 Advisory →

Red Hat 2 advisories

  • RHSA-2025:7085 Released 2025-05-13 · Red Hat rating Moderate
    pcs security update
    • Red Hat Enterprise Linux High Availability (v. 9) pcs-0.11.9-2.el9, pcs-snmp-0.11.9-2.el9
    • Red Hat Enterprise Linux Resilient Storage (v. 9) pcs-0.11.9-2.el9, pcs-snmp-0.11.9-2.el9
  • RHSA-2025:1985 Released 2025-03-05 · Red Hat rating Moderate
    Logging for Red Hat OpenShift - 5.9.12
    • RHOL 5.9 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/eventrouter-rhel9 +9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat 3scale API Management Platform 2AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet: Fix deferred
Red Hat Storage 3AffectedNo fix planned: Out of support scope
RHOL 5.9 for RHEL 9Fixed RHSA-2025:1985
Red Hat Enterprise Linux High Availability (v. 9)Fixed RHSA-2025:7085
Red Hat Enterprise Linux Resilient Storage (v. 9)Fixed RHSA-2025:7085
Not affected: 1 product
  • Red Hat Enterprise Linux 10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-25184
  2. 2026-10-03 Alias added: GHSA-7g2v-jj9q-g3rg

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2024-16580 Rack ReDos in content type parsing (2nd degree polynomial) CVSS 3.1HIGH 7.5
  • TI-2024-17236 Possible Denial of Service Vulnerability in Rack Header Parsing CVSS 3.1HIGH 7.5
  • TI-2024-17231 Possible DoS Vulnerability with Range Header in Rack CVSS 3.1HIGH 7.5
  • TI-2023-12254 Uncontrolled resource consumption in https://github.com/rack/rack CVSS 3.1HIGH 7.5
  • TI-2025-38165 Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) CVSS 3.1HIGH 7.5
  • TI-2025-38163 Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion) CVSS 3.1HIGH 7.5
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences