Information disclosure in Rack - CVE-2025-61780

Vulnerability identifier: #VU116895

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-61780

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to improper handling of headers in "Rack::Sendfile". A remote attacker can bypass proxy-enforced restrictions and access internal endpoints.

Rack
Debian Linux
SUSE Enterprise Server 15 SP3 Business Critical
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Availability Extension 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
openSUSE Leap
Ubuntu
Fedora
IBM Aspera Console
ruby-rack (Ubuntu package)
ruby-rack (Debian package)
ruby2.5-rubygem-rack
ruby2.5-rubygem-rack-doc
rubygem-rack
IBM Cloud Pak for Multicloud Management

Install updates from vendor's website.

Rack - addressed in versions 2.2.20, 3.1.18, 3.2.3
IBM Aspera Console - update to 3.4.8
ruby-rack (Ubuntu package) - addressed in versions 1.6.4-3ubuntu0.2+esm9, 1.6.4-4ubuntu0.2+esm9, 2.0.7-2ubuntu0.1+esm8, 2.1.4-5ubuntu1.2, 2.2.7-1ubuntu0.5, 3.1.16-0.1ubuntu0.1
ruby-rack (Debian package) - addressed in versions 2.2.20-0+deb12u1, 3.1.18-1~deb13u1
ruby2.5-rubygem-rack - update to 2.2.20-150000.3.34.1
ruby2.5-rubygem-rack-doc - update to 2.2.20-150000.3.34.1
rubygem-rack - addressed in versions 2.2.21-1.fc41, 2.2.21-9.fc42, 3.1.19-1.fc43
IBM Cloud Pak for Multicloud Management - update to 2.3 Fix Pack 12

• https://github.com/rack/rack/security/advisories/GHSA-r657-rxjc-j557

• Multiple vulnerabilities in Rack
• Debian update for ruby-rack
• Fedora 43 update for rubygem-rack
• Fedora 42 update for rubygem-rack
• Fedora 41 update for rubygem-rack
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• SUSE update for rubygem-rack
• Ubuntu update for ruby-rack
• Multiple vulnerabilities in IBM Aspera Console