Rack::Request#host_with_port, and therefore #base_url and #url, return the raw authority string when it fails validation. An attacker-controlled Host, X-Forwarded-Host, or Forwarded: host= value containing characters that are not permitted in an authority is embedded verbatim in URLs generated by the application.

This completes the fix for CVE-2026-34835 (GHSA-g2pf-xv49-m2h5), which made #host and #hostname return nil for an invalid authority but left this path unchanged.

Impact

Applications that build absolute URLs, redirects, or origin-dependent checks from req.url, req.base_url, or req.host_with_port, and that do not enforce a host allowlist, may emit URLs containing attacker-chosen characters such as @, /, ?, #, spaces, or angle brackets. Generated links and Location headers can be redirected through userinfo tricks, string-based URL checks can be bypassed, and markup is reflected where the application does not escape the value. For example, redirect in Sinatra behind a proxy that forwards X-Forwarded-Host emits the raw invalid authority in Location.

Rails overrides these methods in Action Dispatch and is not expected to be affected. Rack 3.1 and 3.2 are affected. Rack 2.2 did not receive the CVE-2026-34835 change and returns the raw value from every host method.