{"action":"Upgrade rack to 2.2.11 or later.","affected":[{"fixed":"2.2.11","introduced":"0"},{"fixed":"3.0.12","introduced":"3.0"},{"fixed":"3.1.10","introduced":"3.1"}],"component":"rack","cve_ids":["CVE-2025-25184"],"ecosystem":"RubyGems","epss":0.01185,"exploited":false,"fixed_versions":["2.2.11","3.0.12","3.1.10"],"ghsa_id":"GHSA-7g2v-jj9q-g3rg","id":"tcs_01M5KEHQBSP77WWFPKPXF81JH1","modified_at":"2026-09-10T03:50:22.687203562Z","published_at":"2025-02-12T19:18:35Z","references":["https://osv.dev/vulnerability/GHSA-7g2v-jj9q-g3rg","https://github.com/rack/rack/security/advisories/GHSA-7g2v-jj9q-g3rg","https://nvd.nist.gov/vuln/detail/CVE-2025-25184","https://github.com/rack/rack/commit/074ae244430cda05c27ca91cda699709cfb3ad8e","https://github.com/rack/rack","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2025-25184.yml","https://lists.debian.org/debian-lts-announce/2025/03/msg00016.html"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-7g2v-jj9q-g3rg","url":"https://osv.dev/vulnerability/GHSA-7g2v-jj9q-g3rg"}],"summary":"Possible Log Injection in Rack::CommonLogger"}