CVE-2026-32762 | Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21 and 3.2.0 to before 3.2.6, Rack::Utils.forwarded_values parses the RFC 7239 Forwarded header by splitting on semicolons before handling quoted-string values. Because quoted values may legally contain semicolons, a header can be interpreted by Rack as multiple Forwarded directives rather than as a single quoted for value. In deployments where an upstream proxy, WAF, or intermediary validates or preserves quoted Forwarded values differently, this discrepancy can allow an attacker to smuggle host, proto, for, or by parameters through a single header value. This issue has been patched in versions 3.1.21 and 3.2.6.

Published: 2026-04-02 Last update: 2026-06-17 Assigner: [email protected] Source: [email protected]
NVD Status：Analyzed，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2026-32762 is rated Low Risk (22/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.18%). Monitor for updates and reassess as exploit intelligence or EPSS changes.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2026-32762

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 0.05% 0.18% +0.13%
2 2026-06-09 0.03% 0.05% +0.02%
3 2026-04-03 — 0.03% —

Full EPSS history (3 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2026-32762

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
4.8 3.1 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H)
Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L)
Some sensitive info could get out, but not a total data dump.
Integrity (I:L)
Attackers could change some data, but it’s limited—not everything goes.
Availability (A:N)
Service keeps running; no real outage angle.
 2.2 2.5 [email protected]
6.5 3.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L)
Some sensitive info could get out, but not a total data dump.
Integrity (I:L)
Attackers could change some data, but it’s limited—not everything goes.
Availability (A:N)
Service keeps running; no real outage angle.
 3.9 2.5 [email protected]

Weakness enumeration for CVE-2026-32762

GitHub Security Advisory for CVE-2026-32762

GHSA-qfgr-crr9-7r49 · Severity: medium · Ecosystem: rubygems — Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing

OS Trackers for CVE-2026-32762

vendor priority summary link
debian not yet assigned CVE-2026-32762 not yet assigned priority: Debian including 1 source packages (ruby-rack), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): open 3, resolved 2. https://security-tracker.debian.org/tracker/CVE-2026-32762
redhat medium — https://access.redhat.com/security/cve/CVE-2026-32762
suse medium CVE-2026-32762 severity moderate: SUSE including 12 source package names (hawk2, rmt-server, …), 54 product×package rows across 22 product lines (SUSE Linux Enterprise High Availability Extension 12 SP5, SUSE Linux Enterprise High Availability Extension 15 SP4, … (22 product lines)): Known Not Affected 54. https://www.suse.com/security/cve/CVE-2026-32762/
ubuntu medium CVE-2026-32762 medium priority: Ubuntu including 1 source packages (ruby-rack), 9 status rows across 9 suites (bionic, focal, jammy, noble, questing, resolute, trusty, upstream, xenial): not-affected 7, needed 1, released 1. https://ubuntu.com/security/CVE-2026-32762

Affected software / configurations for CVE-2026-32762

Vendor Product Version Raw CPE
rack rack >= 3.0.0, < 3.1.21 cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*
rack rack >= 3.2.0, < 3.2.6 cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*

References for CVE-2026-32762

cvelogic Threat Intelligence