{"action":"Upgrade thin to 1.2.4-1 or later.","affected":[{"fixed":"1.2.4-1","introduced":"0"}],"component":"thin","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["1.2.4-1"],"id":"tcs_01M5N9BVMBK866PCCXFKV4B4NW","modified_at":"2026-10-23T17:47:40.542725195Z","published_at":"2009-09-22T10:30:00.640Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2009-3287","https://security-tracker.debian.org/tracker/CVE-2009-3287"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2009-3287#Debian:13/thin","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2009-3287"}],"summary":"lib/thin/connection.rb in Thin web server before 1.2.4 relies on the X-Forwarded-For header to determine the IP address of the client, which allows remote attackers to spoof the IP address and hide ac"}