CVE-2026-32762: Rack Header Parsing Vulnerability

CVE-2026-32762 Overview

CVE-2026-32762 is an HTTP Request Smuggling vulnerability in Rack, the modular Ruby web server interface. The vulnerability exists in Rack::Utils.forwarded_values, which parses RFC 7239 Forwarded headers by incorrectly splitting on semicolons before properly handling quoted-string values. Since quoted values may legally contain semicolons per the RFC specification, this parsing flaw allows a malicious header to be interpreted by Rack as multiple Forwarded directives rather than a single quoted for value.

Critical Impact

In deployments where upstream proxies, WAFs, or intermediaries validate or preserve quoted Forwarded values differently, attackers can smuggle host, proto, for, or by parameters through a single header value, potentially bypassing security controls and enabling request smuggling attacks.

Affected Products

• Rack versions 3.0.0.beta1 to before 3.1.21
• Rack versions 3.2.0 to before 3.2.6
• Ruby web applications using vulnerable Rack middleware

Discovery Timeline

• 2026-04-02 - CVE CVE-2026-32762 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-32762

Vulnerability Analysis

This vulnerability is classified under CWE-436 (Interpretation Conflict), which occurs when software components interpret the same input differently, leading to security issues. The root cause lies in how Rack::Utils.forwarded_values processes the RFC 7239 Forwarded header.

The RFC 7239 specification defines the Forwarded header format and allows quoted-string values that may contain semicolons as part of the value. However, Rack's implementation splits the header on semicolons before properly parsing quoted strings, causing interpretation conflicts between Rack and upstream security components.

This discrepancy creates an HTTP Request Smuggling scenario where an attacker can craft a Forwarded header that passes validation by an upstream proxy or WAF but is parsed differently by the Rack application, allowing smuggled parameters to influence request handling.

Root Cause

The vulnerability stems from incorrect parsing order in Rack::Utils.forwarded_values. The function splits the Forwarded header value on semicolons as a first step, without accounting for semicolons that appear within RFC-compliant quoted-string values. This violates the RFC 7239 specification, which requires proper handling of quoted content before tokenization.

When a quoted value such as for="192.168.1.1;malicious" is processed, Rack incorrectly interprets the semicolon within the quotes as a directive separator rather than part of the quoted value, leading to unexpected parameter injection.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request with a specially formatted Forwarded header to a target application. The header contains quoted values with embedded semicolons that upstream proxies or WAFs treat as single values, but Rack splits into multiple directives.

This allows the attacker to:

• Smuggle arbitrary host, proto, for, or by parameters
• Bypass IP-based access controls by injecting false for values
• Manipulate protocol detection by injecting proto parameters
• Potentially bypass WAF rules that inspect Forwarded headers

The vulnerability manifests in the Forwarded header parsing logic within Rack::Utils.forwarded_values. The parsing incorrectly handles semicolons within quoted strings, splitting the value prematurely. For detailed technical analysis and proof-of-concept examples, see the GitHub Security Advisory.

Detection Methods for CVE-2026-32762

Indicators of Compromise

• Unusual or malformed Forwarded headers in access logs containing semicolons within quoted values
• Discrepancies between proxy-logged client IPs and application-logged client IPs
• Access log entries showing requests that should have been blocked by IP-based restrictions
• WAF logs indicating allowed requests followed by unexpected application behavior

Detection Strategies

• Implement HTTP header inspection rules to identify Forwarded headers with quoted values containing semicolons
• Compare Forwarded header parsing results between edge proxies and application servers for discrepancies
• Deploy application-level logging to capture raw Forwarded header values before and after parsing
• Monitor for requests where the resolved client IP differs between proxy and application layers

Monitoring Recommendations

• Enable verbose logging for all HTTP header parsing operations in Rack applications
• Configure WAF rules to flag requests with complex Forwarded headers containing both quotes and semicolons
• Set up alerts for anomalous patterns in client IP resolution across the request chain
• Review application access patterns for signs of IP-based access control bypass

How to Mitigate CVE-2026-32762

Immediate Actions Required

• Upgrade Rack to version 3.1.21 or later for the 3.1.x branch
• Upgrade Rack to version 3.2.6 or later for the 3.2.x branch
• Review application code that relies on Rack::Utils.forwarded_values for security decisions
• Audit access logs for potential exploitation attempts using the detection indicators above

Patch Information

Security patches are available in Rack versions 3.1.21 and 3.2.6. The patches correct the parsing order in Rack::Utils.forwarded_values to properly handle quoted-string values before splitting on semicolons, ensuring RFC 7239 compliance. For additional details, refer to the GitHub Security Advisory.

Workarounds

• Configure upstream proxies to normalize or strip Forwarded headers before they reach the application
• Implement application-level validation of Forwarded header values before using them for security decisions
• Use alternative headers such as X-Forwarded-For if your infrastructure supports them, though note these have their own security considerations
• Deploy a reverse proxy that rewrites Forwarded headers to a canonical format

# Example Nginx configuration to strip or normalize Forwarded headers
# Add to your server or location block to prevent header smuggling

# Option 1: Strip the Forwarded header entirely
proxy_set_header Forwarded "";

# Option 2: Set a trusted value from Nginx variables
proxy_set_header Forwarded "for=$remote_addr;proto=$scheme;host=$host";