CVE-2026-32762: 
Ruby vulnerability analysis and mitigation

CVE-2026-32762 is a Forwarded header semicolon injection vulnerability in the Rack Ruby web server interface that enables Host and Scheme spoofing. It affects Rack versions 3.0.0.beta1 through before 3.1.21 and 3.2.0 through before 3.2.6. The vulnerability was published on April 1–2, 2026, and patched versions 3.1.21 and 3.2.6 were released simultaneously. It carries a CVSS v3.1 base score of 4.8 (Moderate) per the GitHub Security Advisory, though NVD assigned a score of 6.5 (Medium) (GitHub Advisory, Rack Advisory).

The root cause is an interpretation conflict (CWE-436) in Rack::Utils.forwarded_values, which parses the RFC 7239 Forwarded header by splitting on semicolons (;) before processing quoted-string values. Because RFC 7239 permits semicolons as literal content within quoted strings, a crafted header such as Forwarded: for="127.0.0.1;host=evil.com;proto=https" is incorrectly split by Rack into multiple directives (for, host, proto) rather than treated as a single for value. The vulnerable parsing logic is equivalent to calling forwarded_header.split(';') prior to any name=value pair parsing, which is inconsistent with the RFC specification. Exploitation requires a deployment where an upstream proxy, WAF, or intermediary preserves or validates the quoted Forwarded value differently from Rack, creating the interpretation discrepancy that enables parameter smuggling (Rack Advisory, GitHub Advisory).

Successful exploitation allows an attacker to smuggle attacker-controlled values for host, proto, for, or by parameters into Rack's derived request metadata, including req.host, req.scheme, req.base_url, and req.url. Applications that use these values for security-sensitive operations — such as generating password reset links, constructing redirects, absolute URL generation, logging, IP-based access decisions, or backend requests — may be vulnerable to host or scheme spoofing attacks. There is no availability impact, but both confidentiality and integrity are partially affected; the practical severity depends heavily on deployment architecture and whether clients can already supply arbitrary trusted Forwarded parameters (Rack Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.05% (16th percentile), indicating a low near-term exploitation probability. Exploitation requires a specific deployment architecture where an upstream component and Rack interpret the same Forwarded header differently, raising the effective attack complexity.

1. Identify target: Locate a Ruby web application using Rack versions 3.0.0.beta1–3.1.20 or 3.2.0–3.2.5 that sits behind a reverse proxy, WAF, or load balancer that preserves quoted Forwarded header values.
2. Craft malicious header: Construct a Forwarded header with a quoted for value containing embedded semicolons and injected parameters, e.g., Forwarded: for="127.0.0.1;host=evil.com;proto=https".
3. Send request: Submit an HTTP request to the target application with the crafted Forwarded header. The upstream intermediary passes the header through as a single quoted value (treating it as valid RFC 7239 content).
4. Trigger parsing discrepancy: Rack's forwarded_values method splits on the semicolon before handling quoted strings, causing it to interpret host=evil.com and proto=https as separate directives rather than literal content of the for value.
5. Achieve spoofing: The application now derives req.host as evil.com and req.scheme as https, enabling the attacker to influence password reset link generation, open redirects, absolute URL construction, or logging outputs with attacker-controlled values (Rack Advisory).

• Network: Inbound HTTP requests containing Forwarded headers with quoted values that include embedded semicolons and additional key=value pairs (e.g., Forwarded: for="<ip>;host=<domain>;proto=https").
• Logs: Application or access logs showing unexpected or attacker-controlled values for Host, scheme, or base URL fields that differ from the actual request origin; password reset emails or redirect URLs referencing external or unexpected domains.
• Application Behavior: Anomalous req.host, req.scheme, or req.base_url values in application logs that do not match the configured server hostname or the upstream proxy's reported values.

Upgrade Rack to version 3.1.21 (for 3.1.x users) or 3.2.6 (for 3.2.x users), which fix the parsing of Forwarded quoted-string values before splitting on parameter delimiters (Rack Advisory). As a configuration-based workaround, strip inbound Forwarded headers at the edge (reverse proxy or WAF) and reconstruct them from trusted proxy metadata rather than passing client-supplied values through. Additionally, avoid using req.host, req.scheme, req.base_url, or req.url for security-sensitive operations (e.g., password reset links, redirects) unless the forwarding chain is explicitly trusted and validated. IBM has also issued advisories for affected products including IBM Aspera Faspex, Aspera Enterprise WebApps, Aspera Shares, and API Connect (IBM Aspera Faspex, IBM API Connect).

Ubuntu issued security notice USN-8182-1 addressing this vulnerability in the ruby-rack package (Ubuntu Advisory). IBM published multiple security bulletins covering affected products including Aspera Faspex, Aspera Enterprise WebApps, Aspera Shares, and API Connect (IBM Aspera Faspex). The vulnerability was credited to reporter th4s1s, with remediation development by jeremyevans and coordination by ioquatix (Rack Advisory). No significant broader social media or researcher commentary has been identified beyond standard vulnerability tracking coverage.