CVE-2026-125109

## Summary `Rack::Request#host_with_port`, and therefore `#base_url` and `#url`, return the raw authority string when it fails validation. An attacker-controlled `Host`, `X-Forwarded-Host`, or `Forwarded: host=` value containing characters that are not permitted in an authority is embedded verbatim in URLs generated by the application. This completes the fix for CVE-2026-34835 (GHSA-g2pf-xv49-m2h5), which made `#host` and `#hostname` return `nil` for an invalid authority but left this path unchanged. ## Details `Rack::Request#host_with_port` splits the authority with `split_authority`. When the `AUTHORITY` pattern does not match, no components are returned and `host_with_port` falls back to returning the unvalidated authority string. `base_url` is `"#{scheme}://#{host_with_port}"` and `url` appends the full path, so both inherit the raw value. For a request with `Host: evil.com/@legit.com`, `host` returns `nil` while `host_with_port` returns `evil.com/@legit.com` and `base_url` returns `http://evil.com/@legit.com`. A valid `Host` together with an invalid `X-Forwarded-Host` produces the same result, because forwarded headers take priority by default. ## Impact Applications that build absolute URLs, redirects, or origin-dependent checks from `req.url`, `req.base_url`, or `req.host_with_port`, and that do not enforce a host allowlist, may emit URLs containing attacker-chosen characters such as `@`, `/`, `?`, `#`, spaces, or angle brackets. Generated links and `Location` headers can be redirected through userinfo tricks, string-based URL checks can be bypassed, and markup is reflected where the application does not escape the value. For example, `redirect` in Sinatra behind a proxy that forwards `X-Forwarded-Host` emits the raw invalid authority in `Location`. Rails overrides these methods in Action Dispatch and is not expected to be affected. Rack 3.1 and 3.2 are affected. Rack 2.2 did not receive the CVE-2026-34835 change and returns the raw value from every h