CVE-2025-27111
Rack ≤ 2.2.12
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-27111 is a medium-severity CRLF Injection (CWE-93) vulnerability in Rack Rack. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Content Injection (T1659); ranked in the top 49% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-27111 is a log injection vulnerability in the Rack::Sendfile middleware of Rack, a modular Ruby web server interface. The middleware logs unsanitized values from the X-Sendfile-Type header, enabling attackers to inject escape sequences such as newline characters into server logs. This affects Rack versions prior to the fixed releases of 2.2.12, 3.0.13, and 3.1.11, and is associated with CWE-93 and CWE-117.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), making it remotely exploitable over the network with low attack complexity, no privileges, and no user interaction required. Unauthenticated attackers who can send HTTP requests to an affected Rack-based web server can include crafted payloads in the X-Sendfile-Type header, achieving log injection that compromises log integrity.
Advisories recommend upgrading to Rack 2.2.12, 3.0.13, or 3.1.11, which address the issue through commit-level fixes sanitizing the header value, as documented in GitHub commits 803aa221e8302719715e224f4476e438f2531a53, aeac570bb8080ca7b53b7f2e2f67498be7ebd30b, and b13bc6bfc7506aca3478dc5ac1c2ec6fc53f82a3, along with the Rack security advisory GHSA-8cgq-6mh2-7j6v. Debian LTS distributions have also announced mitigations in their March 2025 update.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6155
Vulnerability Data
Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection. This…
more
vulnerability is fixed in 2.2.12, 3.0.13, and 3.1.11.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V4.2.4
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing or incorrect output neutralization when log messages are constructed from untrusted input.
Input validation directly stops untrusted data containing CRLF sequences from reaching the component that treats CRLF as a delimiter.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and validation to block CRLF injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect CRLF flaws but does not itself implement the neutralization.
Logging control directly requires proper log generation and handling, which mitigates improper output neutralization.
Monitoring activities rely on trustworthy logs but do not ensure log message integrity.
Secure development lifecycle mandates input validation and output encoding that directly prevents CRLF injection.
Application security requirements include rules for neutralizing special characters such as CRLF in inputs.
Secure architecture principles encourage safe handling of untrusted data but do not prescribe specific CRLF controls.