Hoch 7.4Linux-Server
CVE-2026-126083
actionpack: actionpack: IP address spoofing via crafted Forwarded header
actionpack
### Impact Since Rails 8.1.0, `ActionDispatch::RemoteIp` derives `request.remote_ip` from `Rack::Request#forwarded_for`, which under Rack 3 reads the RFC 7239 `Forwarded` header in preference to `X-Forwarded-For`. When a reverse proxy appends the client address to `X-Forwarded-For` but passes a client-supplied `Forwarded` header through unchanged, `request.remote_ip` returns an address chosen by the client, and the IP spoofing check does not raise, because it compares only…
10. Nov 2026
Original bei Red Hat öffnen