RUBY ON RAILS · TECH-202611-c2lguf · Runtime
FIX → 8.1.4.1 · 4.2
A researcher's write-up (lkoskela.fi, 5 Nov 2026) shows that several web frameworks read the standard RFC 7239 'Forwarded' request header and trust it over X-Forwarded-*: Ruby on Rails 8.1 before 8.1.4.1 (client IP only), Jetty 12 in its default setup, Spring Boot before 4.2 when forwarded-header handling is on (FRAMEWORK strategy, or NATIVE on Jetty or Reactor Netty), Symfony when Forwarded support is enabled (host name), and the Gorilla ProxyHeaders handler. Almost no proxy or CDN strips this header by default: Envoy/Envoy Gateway, ingress-nginx, Traefik, Apache, Caddy, Kong, Cloudflare and CloudFront pass it through, and per their docs AWS ALB, Google Cloud and Azure load balancers probably do too. 'Trusted proxy' settings do not help. So a client can fake its IP address (getting around IP allowlists and rate limits, faking log entries) and the host name or protocol (poisoned password-reset links that lead to account takeover, web cache poisoning, redirect loops). The researcher found it common across bug bounty targets. Proof of concept only; no attacks in the wild reported. Rails fixed it in 8.1.4.1. Spring Boot 4.2, Spring 7.1 and Reactor Netty 1.4 changed their defaults. Jetty did not change its default. No CVE known.
first public Nov 5, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
8.1.4.1, Jetty 12 (or older), Spring Boot before 4.2 with server.forward-headers-strategy set (FRAMEWORK or NATIVE on Jetty or Reactor Netty), Symfony with the Forwarded trusted header enabled, or Gorilla handlers.ProxyHeaders, AND whether the proxy/CDN in front of it passes the Forwarded header through (the default on Envoy, ingress-nginx, Traefik, Apache, Caddy, Kong, Cloudflare, CloudFront)Forwarded: host=example.com:invalidportPosts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Forwarded: for=127.0.0.1 and see whether the app logs or uses that IPClient-IP and Forwarded: for are sent means Rails is parsing itUpgrade to 8.1.4.1 · 4.2
Forwarded header, and X-Real-IP or any other proxy header you do not set yourself8.1.4.1+ and Spring Boot to 4.2+ (or set the header family explicitly in Spring 7.1 / Reactor Netty 1.4 and older branches)