Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-w732-52bx-2qf8
Vulnerability ID VCID-w732-52bx-2qf8
Aliases CVE-2025-25184
GHSA-7g2v-jj9q-g3rg
Summary Possible Log Injection in Rack::CommonLogger ## Summary `Rack::CommonLogger` can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. ## Details When a user provides the authorization credentials via `Rack::Auth::Basic`, if success, the username will be put in `env['REMOTE_USER']` and later be used by `Rack::CommonLogger` for logging purposes. The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the logfile. ## Impact Attackers can break log formats or insert fraudulent entries, potentially obscuring real activity or injecting malicious data into log files. ## Mitigation - Update to the latest version of Rack.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-117 Improper Output Neutralization for Logs
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 6.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-25184.json
epss 0.01039 https://api.first.org/data/v1/epss?cve=CVE-2025-25184
epss 0.01039 https://api.first.org/data/v1/epss?cve=CVE-2025-25184
epss 0.01039 https://api.first.org/data/v1/epss?cve=CVE-2025-25184
epss 0.01039 https://api.first.org/data/v1/epss?cve=CVE-2025-25184
epss 0.01039 https://api.first.org/data/v1/epss?cve=CVE-2025-25184
epss 0.01039 https://api.first.org/data/v1/epss?cve=CVE-2025-25184
epss 0.01068 https://api.first.org/data/v1/epss?cve=CVE-2025-25184
epss 0.01068 https://api.first.org/data/v1/epss?cve=CVE-2025-25184
cvssv3.1 4.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-7g2v-jj9q-g3rg
cvssv3.1 6.5 https://github.com/rack/rack
cvssv4 5.7 https://github.com/rack/rack
generic_textual MODERATE https://github.com/rack/rack
cvssv3.1 6.5 https://github.com/rack/rack/commit/074ae244430cda05c27ca91cda699709cfb3ad8e
cvssv4 5.7 https://github.com/rack/rack/commit/074ae244430cda05c27ca91cda699709cfb3ad8e
generic_textual MODERATE https://github.com/rack/rack/commit/074ae244430cda05c27ca91cda699709cfb3ad8e
ssvc Track https://github.com/rack/rack/commit/074ae244430cda05c27ca91cda699709cfb3ad8e
cvssv3 6.5 https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg
cvssv3.1 6.5 https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg
cvssv3.1_qr MODERATE https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg
cvssv4 5.7 https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg
generic_textual MODERATE https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg
ssvc Track https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg
cvssv3.1 6.5 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-25184.yml
cvssv4 5.7 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-25184.yml
generic_textual MODERATE https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-25184.yml
cvssv3.1 6.5 https://lists.debian.org/debian-lts-announce/2025/03/msg00016.html
cvssv4 5.7 https://lists.debian.org/debian-lts-announce/2025/03/msg00016.html
generic_textual MODERATE https://lists.debian.org/debian-lts-announce/2025/03/msg00016.html
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2025-25184
cvssv4 5.7 https://nvd.nist.gov/vuln/detail/CVE-2025-25184
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-25184
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-25184.json
https://api.first.org/data/v1/epss?cve=CVE-2025-25184
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-25184
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/rack/rack
https://github.com/rack/rack/commit/074ae244430cda05c27ca91cda699709cfb3ad8e
https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-25184.yml
https://lists.debian.org/debian-lts-announce/2025/03/msg00016.html
https://nvd.nist.gov/vuln/detail/CVE-2025-25184
1098257 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098257
2345301 https://bugzilla.redhat.com/show_bug.cgi?id=2345301
GHSA-7g2v-jj9q-g3rg https://github.com/advisories/GHSA-7g2v-jj9q-g3rg
RHSA-2025:1985 https://access.redhat.com/errata/RHSA-2025:1985
RHSA-2025:7085 https://access.redhat.com/errata/RHSA-2025:7085
USN-7366-1 https://usn.ubuntu.com/7366-1/
USN-7366-2 https://usn.ubuntu.com/7366-2/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-25184.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/rack/rack
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P Found at https://github.com/rack/rack
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/rack/rack/commit/074ae244430cda05c27ca91cda699709cfb3ad8e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P Found at https://github.com/rack/rack/commit/074ae244430cda05c27ca91cda699709cfb3ad8e
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T19:09:07Z/ Found at https://github.com/rack/rack/commit/074ae244430cda05c27ca91cda699709cfb3ad8e
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P Found at https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T19:09:07Z/ Found at https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-25184.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-25184.yml
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://lists.debian.org/debian-lts-announce/2025/03/msg00016.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P Found at https://lists.debian.org/debian-lts-announce/2025/03/msg00016.html
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-25184
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P Found at https://nvd.nist.gov/vuln/detail/CVE-2025-25184
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.77375
EPSS Score 0.01039
Published At April 7, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:55:40.777676+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-7g2v-jj9q-g3rg/GHSA-7g2v-jj9q-g3rg.json 38.0.0