Skip to content
cve.newCreate a CVE report

actionpack

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

high7.4
CVE-2026-126083Package fixes recorded

Action Pack: Possible IP spoofing in Action Dispatch RemoteIp

Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remote_ip from Rack::Request#forwarded_for, which under Rack 3 reads the RFC 7239 Forwarded header in preference to X-Forwarded-For. When a reverse proxy appends the client address to X-Forwarded-For but passes a client-supplied Forwarded header through unchanged, request.remote_ip returns an address chosen by the client, and the IP spoofing check does not raise, because it compares only Client-Ip with the forwarded addresses. An unauthenticated attacker could therefore spoof request.remote_ip, possibly bypassing IP-based access controls and rate limits keyed on the client address (including the default by: of rate_limit), and falsifying the client address in logs.

Recorded fixes — actionpack: 8.1.4.1. Check your release branch.

Exploitation not established

RubyGems / actionpack
actionpack RubyGems
Affected range Recorded fix
From 8.1.0.beta1 before 8.1.4.1Ecosystem versions8.1.4.1

Version evidence: OSV · GHSA-2gff-2mmg-m73p

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "8.1.0.beta1"
        },
        {
          "fixed": "8.1.4.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "8.1.0",
    "8.1.0.beta1",
    "8.1.0.rc1",
    "8.1.1",
    "8.1.2",
    "8.1.2.1",
    "8.1.3",
    "8.1.3.1",
    "8.1.4"
  ]
}
high7.5
CVE-2026-126081Package fixes recorded

Action Pack: Possible Strong Parameters Bypass in Parameters#each_key

ActionController::Parameters#each_key delegates to the internal ActiveSupport::HashWithIndifferentAccess that holds the request parameters, so when called with a block it returns that hash instead of the Parameters instance. The hash does not respond to permitted?, so Active Model mass assignment (new, assign_attributes, update) accepts it without raising ActiveModel::ForbiddenAttributesError. An application that passes the return value of each_key to mass assignment could allow a remote, unauthenticated attacker to set attributes that the application does not permit, such as an authorization flag.

Recorded fixes — actionpack: 8.1.4.1 or 8.0.5.2. Check your release branch.

Exploitation not established

RubyGems / actionpack
actionpack RubyGems
Affected range Recorded fix
From 8.1.0.beta1 before 8.1.4.1Ecosystem versions8.1.4.1

Version evidence: OSV · GHSA-wm3x-v3qw-4jh3

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "8.1.0.beta1"
        },
        {
          "fixed": "8.1.4.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "8.1.0",
    "8.1.0.beta1",
    "8.1.0.rc1",
    "8.1.1",
    "8.1.2",
    "8.1.2.1",
    "8.1.3",
    "8.1.3.1",
    "8.1.4"
  ]
}
actionpack RubyGems
Affected range Recorded fix
Earlier releases before 8.0.5.2Ecosystem versions8.0.5.2

Version evidence: OSV · GHSA-wm3x-v3qw-4jh3

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "8.0.5.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.9.0",
    "0.9.5",
    "1.0.0",
    "1.0.1",
    "1.1.0",
    "1.10.1",
    "1.10.2",
    "1.11.0",
    "1.11.1",
    "1.11.2",
    "1.12.0",
    "1.12.1",
    "1.12.2",
    "1.12.3",
    "1.12.4",
    "1.12.5",
    "1.13.0",
    "1.13.1",
    "1.13.2",
    "1.13.3",
    "1.13.4",
    "1.13.5",
    "1.13.6",
    "1.2.0",
    "1.3.0",
    "1.3.1",
    "1.4.0",
    "1.5.0",
    "1.5.1",
    "1.6.0",
    "1.7.0",
    "1.8.0",
    "1.8.1",
    "1.9.0",
    "1.9.1",
    "2.0.0",
    "2.0.1",
    "2.0.2",
    "2.0.4",
    "2.0.5",
    "2.1.0",
    "2.1.1",
    "2.1.2",
    "2.2.2",
    "2.2.3",
    "2.3.10",
    "2.3.11",
    "2.3.12",
    "2.3.14",
    "2.3.15",
    "2.3.16",
    "2.3.17",
    "2.3.18",
    "2.3.2",
    "2.3.3",
    "2.3.4",
    "2.3.5",
    "2.3.6",
    "2.3.7",
    "2.3.8",
    "2.3.8.pre1",
    "2.3.9",
    "2.3.9.pre",
    "3.0.0",
    "3.0.0.beta",
    "3.0.0.beta2",
    "3.0.0.beta3",
    "3.0.0.beta4",
    "3.0.0.rc",
    "3.0.0.rc2",
    "3.0.1",
    "3.0.10",
    "3.0.10.rc1",
    "3.0.11",
    "3.0.12",
    "3.0.12.rc1",
    "3.0.13",
    "3.0.13.rc1",
    "3.0.14",
    "3.0.15",
    "3.0.16",
    "3.0.17",
    "3.0.18",
    "3.0.19",
    "3.0.2",
    "3.0.20",
    "3.0.3",
    "3.0.4",
    "3.0.4.rc1",
    "3.0.5",
    "3.0.5.rc1",
    "3.0.6",
    "3.0.6.rc1",
    "3.0.6.rc2",
    "3.0.7",
    "3.0.7.rc1",
    "3.0.7.rc2",
    "3.0.8",
    "3.0.8.rc1",
    "3.0.8.rc2",
    "3.0.8.rc4",
    "3.0.9",
    "3.0.9.rc1",
    "3.0.9.rc3",
    "3.0.9.rc4",
    "3.0.9.rc5",
    "3.1.0",
    "3.1.0.beta1",
    "3.1.0.rc1",
    "3.1.0.rc2",
    "3.1.0.rc3",
    "3.1.0.rc4",
    "3.1.0.rc5",
    "3.1.0.rc6",
    "3.1.0.rc8",
    "3.1.1",
    "3.1.1.rc1",
    "3.1.1.rc2",
    "3.1.1.rc3",
    "3.1.10",
    "3.1.11",
    "3.1.12",
    "3.1.2",
    "3.1.2.rc1",
    "3.1.2.rc2",
    "3.1.3",
    "3.1.4",
    "3.1.4.rc1",
    "3.1.5",
    "3.1.5.rc1",
    "3.1.6",
    "3.1.7",
    "3.1.8",
    "3.1.9",
    "3.2.0",
    "3.2.0.rc1",
    "3.2.0.rc2",
    "3.2.1",
    "3.2.10",
    "3.2.11",
    "3.2.12",
    "3.2.13",
    "3.2.13.rc1",
    "3.2.13.rc2",
    "3.2.14",
    "3.2.14.rc1",
    "3.2.14.rc2",
    "3.2.15",
    "3.2.15.rc1",
    "3.2.15.rc2",
    "3.2.15.rc3",
    "3.2.16",
    "3.2.17",
    "3.2.18",
    "3.2.19",
    "3.2.2",
    "3.2.2.rc1",
    "3.2.20",
    "3.2.21",
    "3.2.22",
    "3.2.22.1",
    "3.2.22.2",
    "3.2.22.3",
    "3.2.22.4",
    "3.2.22.5",
    "3.2.3",
    "3.2.3.rc1",
    "3.2.3.rc2",
    "3.2.4",
    "3.2.4.rc1",
    "3.2.5",
    "3.2.6",
    "3.2.7",
    "3.2.7.rc1",
    "3.2.8",
    "3.2.8.rc1",
    "3.2.8.rc2",
    "3.2.9",
    "3.2.9.rc1",
    "3.2.9.rc2",
    "3.2.9.rc3",
    "4.0.0",
    "4.0.0.beta1",
    "4.0.0.rc1",
    "4.0.0.rc2",
    "4.0.1",
    "4.0.1.rc1",
    "4.0.1.rc2",
    "4.0.1.rc3",
    "4.0.1.rc4",
    "4.0.10",
    "4.0.10.rc1",
    "4.0.10.rc2",
    "4.0.11",
    "4.0.11.1",
    "4.0.12",
    "4.0.13",
    "4.0.13.rc1",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.4.rc1",
    "4.0.5",
    "4.0.6",
    "4.0.6.rc1",
    "4.0.6.rc2",
    "4.0.6.rc3",
    "4.0.7",
    "4.0.8",
    "4.0.9",
    "4.1.0",
    "4.1.0.beta1",
    "4.1.0.beta2",
    "4.1.0.rc1",
    "4.1.0.rc2",
    "4.1.1",
    "4.1.10",
    "4.1.10.rc1",
    "4.1.10.rc2",
    "4.1.10.rc3",
    "4.1.10.rc4",
    "4.1.11",
    "4.1.12",
    "4.1.12.rc1",
    "4.1.13",
    "4.1.13.rc1",
    "4.1.14",
    "4.1.14.1",
    "4.1.14.2",
    "4.1.14.rc1",
    "4.1.14.rc2",
    "4.1.15",
    "4.1.15.rc1",
    "4.1.16",
    "4.1.16.rc1",
    "4.1.2",
    "4.1.2.rc1",
    "4.1.2.rc2",
    "4.1.2.rc3",
    "4.1.3",
    "4.1.4",
    "4.1.5",
    "4.1.6",
    "4.1.6.rc1",
    "4.1.6.rc2",
    "4.1.7",
    "4.1.7.1",
    "4.1.8",
    "4.1.9",
    "4.1.9.rc1",
    "4.2.0",
    "4.2.0.beta1",
    "4.2.0.beta2",
    "4.2.0.beta3",
    "4.2.0.beta4",
    "4.2.0.rc1",
    "4.2.0.rc2",
    "4.2.0.rc3",
    "4.2.1",
    "4.2.1.rc1",
    "4.2.1.rc2",
    "4.2.1.rc3",
    "4.2.1.rc4",
    "4.2.10",
    "4.2.10.rc1",
    "4.2.11",
    "4.2.11.1",
    "4.2.11.2",
    "4.2.11.3",
    "4.2.2",
    "4.2.3",
    "4.2.3.rc1",
    "4.2.4",
    "4.2.4.rc1",
    "4.2.5",
    "4.2.5.1",
    "4.2.5.2",
    "4.2.5.rc1",
    "4.2.5.rc2",
    "4.2.6",
    "4.2.6.rc1",
    "4.2.7",
    "4.2.7.1",
    "4.2.7.rc1",
    "4.2.8",
    "4.2.8.rc1",
    "4.2.9",
    "4.2.9.rc1",
    "4.2.9.rc2",
    "5.0.0",
    "5.0.0.1",
    "5.0.0.beta1",
    "5.0.0.beta1.1",
    "5.0.0.beta2",
    "5.0.0.beta3",
    "5.0.0.beta4",
    "5.0.0.racecar1",
    "5.0.0.rc1",
    "5.0.0.rc2",
    "5.0.1",
    "5.0.1.rc1",
    "5.0.1.rc2",
    "5.0.2",
    "5.0.2.rc1",
    "5.0.3",
    "5.0.4",
    "5.0.4.rc1",
    "5.0.5",
    "5.0.5.rc1",
    "5.0.5.rc2",
    "5.0.6",
    "5.0.6.rc1",
    "5.0.7",
    "5.0.7.1",
    "5.0.7.2",
    "5.1.0",
    "5.1.0.beta1",
    "5.1.0.rc1",
    "5.1.0.rc2",
    "5.1.1",
    "5.1.2",
    "5.1.2.rc1",
    "5.1.3",
    "5.1.3.rc1",
    "5.1.3.rc2",
    "5.1.3.rc3",
    "5.1.4",
    "5.1.4.rc1",
    "5.1.5",
    "5.1.5.rc1",
    "5.1.6",
    "5.1.6.1",
    "5.1.6.2",
    "5.1.7",
    "5.1.7.rc1",
    "5.2.0",
    "5.2.0.beta1",
    "5.2.0.beta2",
    "5.2.0.rc1",
    "5.2.0.rc2",
    "5.2.1",
    "5.2.1.1",
    "5.2.1.rc1",
    "5.2.2",
    "5.2.2.1",
    "5.2.2.rc1",
    "5.2.3",
    "5.2.3.rc1",
    "5.2.4",
    "5.2.4.1",
    "5.2.4.2",
    "5.2.4.3",
    "5.2.4.4",
    "5.2.4.5",
    "5.2.4.6",
    "5.2.4.rc1",
    "5.2.5",
    "5.2.6",
    "5.2.6.1",
    "5.2.6.2",
    "5.2.6.3",
    "5.2.7",
    "5.2.7.1",
    "5.2.8",
    "5.2.8.1",
    "6.0.0",
    "6.0.0.beta1",
    "6.0.0.beta2",
    "6.0.0.beta3",
    "6.0.0.rc1",
    "6.0.0.rc2",
    "6.0.1",
    "6.0.1.rc1",
    "6.0.2",
    "6.0.2.1",
    "6.0.2.2",
    "6.0.2.rc1",
    "6.0.2.rc2",
    "6.0.3",
    "6.0.3.1",
    "6.0.3.2",
    "6.0.3.3",
    "6.0.3.4",
    "6.0.3.5",
    "6.0.3.6",
    "6.0.3.7",
    "6.0.3.rc1",
    "6.0.4",
    "6.0.4.1",
    "6.0.4.2",
    "6.0.4.3",
    "6.0.4.4",
    "6.0.4.5",
    "6.0.4.6",
    "6.0.4.7",
    "6.0.4.8",
    "6.0.5",
    "6.0.5.1",
    "6.0.6",
    "6.0.6.1",
    "6.1.0",
    "6.1.0.rc1",
    "6.1.0.rc2",
    "6.1.1",
    "6.1.2",
    "6.1.2.1",
    "6.1.3",
    "6.1.3.1",
    "6.1.3.2",
    "6.1.4",
    "6.1.4.1",
    "6.1.4.2",
    "6.1.4.3",
    "6.1.4.4",
    "6.1.4.5",
    "6.1.4.6",
    "6.1.4.7",
    "6.1.5",
    "6.1.5.1",
    "6.1.6",
    "6.1.6.1",
    "6.1.7",
    "6.1.7.1",
    "6.1.7.10",
    "6.1.7.2",
    "6.1.7.3",
    "6.1.7.4",
    "6.1.7.5",
    "6.1.7.6",
    "6.1.7.7",
    "6.1.7.8",
    "6.1.7.9",
    "7.0.0",
    "7.0.0.alpha1",
    "7.0.0.alpha2",
    "7.0.0.rc1",
    "7.0.0.rc2",
    "7.0.0.rc3",
    "7.0.1",
    "7.0.10",
    "7.0.2",
    "7.0.2.1",
    "7.0.2.2",
    "7.0.2.3",
    "7.0.2.4",
    "7.0.3",
    "7.0.3.1",
    "7.0.4",
    "7.0.4.1",
    "7.0.4.2",
    "7.0.4.3",
    "7.0.5",
    "7.0.5.1",
    "7.0.6",
    "7.0.7",
    "7.0.7.1",
    "7.0.7.2",
    "7.0.8",
    "7.0.8.1",
    "7.0.8.2",
    "7.0.8.3",
    "7.0.8.4",
    "7.0.8.5",
    "7.0.8.6",
    "7.0.8.7",
    "7.1.0",
    "7.1.0.beta1",
    "7.1.0.rc1",
    "7.1.0.rc2",
    "7.1.1",
    "7.1.2",
    "7.1.3",
    "7.1.3.1",
    "7.1.3.2",
    "7.1.3.3",
    "7.1.3.4",
    "7.1.4",
    "7.1.4.1",
    "7.1.4.2",
    "7.1.5",
    "7.1.5.1",
    "7.1.5.2",
    "7.1.6",
    "7.2.0",
    "7.2.0.beta1",
    "7.2.0.beta2",
    "7.2.0.beta3",
    "7.2.0.rc1",
    "7.2.1",
    "7.2.1.1",
    "7.2.1.2",
    "7.2.2",
    "7.2.2.1",
    "7.2.2.2",
    "7.2.3",
    "7.2.3.1",
    "7.2.3.2",
    "7.2.4",
    "8.0.0",
    "8.0.0.1",
    "8.0.0.beta1",
    "8.0.0.rc1",
    "8.0.0.rc2",
    "8.0.1",
    "8.0.2",
    "8.0.2.1",
    "8.0.3",
    "8.0.4",
    "8.0.4.1",
    "8.0.5",
    "8.0.5.1"
  ]
}
medium6.8
CVE-2026-126077Package fixes recorded

Action Pack: Possible sensitive session information leak in Active Storage proxy mode

When ActionDispatch::Cookies reads a signed or encrypted cookie that was written under a rotated secret (config.action_dispatch.cookies_rotations) or in the format that a :hybrid cookie serializer migrates from, it writes the cookie back to the response in the current format, and that write ignores request.session_options[:skip]. ActiveStorage::DisableSession relies on that option to keep the session cookie off the public, immutable responses of the Active Storage proxy controllers, but those controllers still load the session, so a request carrying an old-format session cookie could receive the rewritten session cookie in Set-Cookie on a cacheable response. A shared cache that stores such a response together with its Set-Cookie header could then serve one user's session to later requesters of the same URL, or serve an attacker's session to other users.

Recorded fixes — actionpack: 8.1.4.1 or 8.0.5.2. Check your release branch.

Exploitation not established

RubyGems / actionpack
actionpack RubyGems
Affected range Recorded fix
From 8.1.0.beta1 before 8.1.4.1Ecosystem versions8.1.4.1

Version evidence: OSV · GHSA-x6mj-8jx9-qhqv

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "8.1.0.beta1"
        },
        {
          "fixed": "8.1.4.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "8.1.0",
    "8.1.0.beta1",
    "8.1.0.rc1",
    "8.1.1",
    "8.1.2",
    "8.1.2.1",
    "8.1.3",
    "8.1.3.1",
    "8.1.4"
  ]
}
actionpack RubyGems
Affected range Recorded fix
Earlier releases before 8.0.5.2Ecosystem versions8.0.5.2

Version evidence: OSV · GHSA-x6mj-8jx9-qhqv

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "8.0.5.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.9.0",
    "0.9.5",
    "1.0.0",
    "1.0.1",
    "1.1.0",
    "1.10.1",
    "1.10.2",
    "1.11.0",
    "1.11.1",
    "1.11.2",
    "1.12.0",
    "1.12.1",
    "1.12.2",
    "1.12.3",
    "1.12.4",
    "1.12.5",
    "1.13.0",
    "1.13.1",
    "1.13.2",
    "1.13.3",
    "1.13.4",
    "1.13.5",
    "1.13.6",
    "1.2.0",
    "1.3.0",
    "1.3.1",
    "1.4.0",
    "1.5.0",
    "1.5.1",
    "1.6.0",
    "1.7.0",
    "1.8.0",
    "1.8.1",
    "1.9.0",
    "1.9.1",
    "2.0.0",
    "2.0.1",
    "2.0.2",
    "2.0.4",
    "2.0.5",
    "2.1.0",
    "2.1.1",
    "2.1.2",
    "2.2.2",
    "2.2.3",
    "2.3.10",
    "2.3.11",
    "2.3.12",
    "2.3.14",
    "2.3.15",
    "2.3.16",
    "2.3.17",
    "2.3.18",
    "2.3.2",
    "2.3.3",
    "2.3.4",
    "2.3.5",
    "2.3.6",
    "2.3.7",
    "2.3.8",
    "2.3.8.pre1",
    "2.3.9",
    "2.3.9.pre",
    "3.0.0",
    "3.0.0.beta",
    "3.0.0.beta2",
    "3.0.0.beta3",
    "3.0.0.beta4",
    "3.0.0.rc",
    "3.0.0.rc2",
    "3.0.1",
    "3.0.10",
    "3.0.10.rc1",
    "3.0.11",
    "3.0.12",
    "3.0.12.rc1",
    "3.0.13",
    "3.0.13.rc1",
    "3.0.14",
    "3.0.15",
    "3.0.16",
    "3.0.17",
    "3.0.18",
    "3.0.19",
    "3.0.2",
    "3.0.20",
    "3.0.3",
    "3.0.4",
    "3.0.4.rc1",
    "3.0.5",
    "3.0.5.rc1",
    "3.0.6",
    "3.0.6.rc1",
    "3.0.6.rc2",
    "3.0.7",
    "3.0.7.rc1",
    "3.0.7.rc2",
    "3.0.8",
    "3.0.8.rc1",
    "3.0.8.rc2",
    "3.0.8.rc4",
    "3.0.9",
    "3.0.9.rc1",
    "3.0.9.rc3",
    "3.0.9.rc4",
    "3.0.9.rc5",
    "3.1.0",
    "3.1.0.beta1",
    "3.1.0.rc1",
    "3.1.0.rc2",
    "3.1.0.rc3",
    "3.1.0.rc4",
    "3.1.0.rc5",
    "3.1.0.rc6",
    "3.1.0.rc8",
    "3.1.1",
    "3.1.1.rc1",
    "3.1.1.rc2",
    "3.1.1.rc3",
    "3.1.10",
    "3.1.11",
    "3.1.12",
    "3.1.2",
    "3.1.2.rc1",
    "3.1.2.rc2",
    "3.1.3",
    "3.1.4",
    "3.1.4.rc1",
    "3.1.5",
    "3.1.5.rc1",
    "3.1.6",
    "3.1.7",
    "3.1.8",
    "3.1.9",
    "3.2.0",
    "3.2.0.rc1",
    "3.2.0.rc2",
    "3.2.1",
    "3.2.10",
    "3.2.11",
    "3.2.12",
    "3.2.13",
    "3.2.13.rc1",
    "3.2.13.rc2",
    "3.2.14",
    "3.2.14.rc1",
    "3.2.14.rc2",
    "3.2.15",
    "3.2.15.rc1",
    "3.2.15.rc2",
    "3.2.15.rc3",
    "3.2.16",
    "3.2.17",
    "3.2.18",
    "3.2.19",
    "3.2.2",
    "3.2.2.rc1",
    "3.2.20",
    "3.2.21",
    "3.2.22",
    "3.2.22.1",
    "3.2.22.2",
    "3.2.22.3",
    "3.2.22.4",
    "3.2.22.5",
    "3.2.3",
    "3.2.3.rc1",
    "3.2.3.rc2",
    "3.2.4",
    "3.2.4.rc1",
    "3.2.5",
    "3.2.6",
    "3.2.7",
    "3.2.7.rc1",
    "3.2.8",
    "3.2.8.rc1",
    "3.2.8.rc2",
    "3.2.9",
    "3.2.9.rc1",
    "3.2.9.rc2",
    "3.2.9.rc3",
    "4.0.0",
    "4.0.0.beta1",
    "4.0.0.rc1",
    "4.0.0.rc2",
    "4.0.1",
    "4.0.1.rc1",
    "4.0.1.rc2",
    "4.0.1.rc3",
    "4.0.1.rc4",
    "4.0.10",
    "4.0.10.rc1",
    "4.0.10.rc2",
    "4.0.11",
    "4.0.11.1",
    "4.0.12",
    "4.0.13",
    "4.0.13.rc1",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.4.rc1",
    "4.0.5",
    "4.0.6",
    "4.0.6.rc1",
    "4.0.6.rc2",
    "4.0.6.rc3",
    "4.0.7",
    "4.0.8",
    "4.0.9",
    "4.1.0",
    "4.1.0.beta1",
    "4.1.0.beta2",
    "4.1.0.rc1",
    "4.1.0.rc2",
    "4.1.1",
    "4.1.10",
    "4.1.10.rc1",
    "4.1.10.rc2",
    "4.1.10.rc3",
    "4.1.10.rc4",
    "4.1.11",
    "4.1.12",
    "4.1.12.rc1",
    "4.1.13",
    "4.1.13.rc1",
    "4.1.14",
    "4.1.14.1",
    "4.1.14.2",
    "4.1.14.rc1",
    "4.1.14.rc2",
    "4.1.15",
    "4.1.15.rc1",
    "4.1.16",
    "4.1.16.rc1",
    "4.1.2",
    "4.1.2.rc1",
    "4.1.2.rc2",
    "4.1.2.rc3",
    "4.1.3",
    "4.1.4",
    "4.1.5",
    "4.1.6",
    "4.1.6.rc1",
    "4.1.6.rc2",
    "4.1.7",
    "4.1.7.1",
    "4.1.8",
    "4.1.9",
    "4.1.9.rc1",
    "4.2.0",
    "4.2.0.beta1",
    "4.2.0.beta2",
    "4.2.0.beta3",
    "4.2.0.beta4",
    "4.2.0.rc1",
    "4.2.0.rc2",
    "4.2.0.rc3",
    "4.2.1",
    "4.2.1.rc1",
    "4.2.1.rc2",
    "4.2.1.rc3",
    "4.2.1.rc4",
    "4.2.10",
    "4.2.10.rc1",
    "4.2.11",
    "4.2.11.1",
    "4.2.11.2",
    "4.2.11.3",
    "4.2.2",
    "4.2.3",
    "4.2.3.rc1",
    "4.2.4",
    "4.2.4.rc1",
    "4.2.5",
    "4.2.5.1",
    "4.2.5.2",
    "4.2.5.rc1",
    "4.2.5.rc2",
    "4.2.6",
    "4.2.6.rc1",
    "4.2.7",
    "4.2.7.1",
    "4.2.7.rc1",
    "4.2.8",
    "4.2.8.rc1",
    "4.2.9",
    "4.2.9.rc1",
    "4.2.9.rc2",
    "5.0.0",
    "5.0.0.1",
    "5.0.0.beta1",
    "5.0.0.beta1.1",
    "5.0.0.beta2",
    "5.0.0.beta3",
    "5.0.0.beta4",
    "5.0.0.racecar1",
    "5.0.0.rc1",
    "5.0.0.rc2",
    "5.0.1",
    "5.0.1.rc1",
    "5.0.1.rc2",
    "5.0.2",
    "5.0.2.rc1",
    "5.0.3",
    "5.0.4",
    "5.0.4.rc1",
    "5.0.5",
    "5.0.5.rc1",
    "5.0.5.rc2",
    "5.0.6",
    "5.0.6.rc1",
    "5.0.7",
    "5.0.7.1",
    "5.0.7.2",
    "5.1.0",
    "5.1.0.beta1",
    "5.1.0.rc1",
    "5.1.0.rc2",
    "5.1.1",
    "5.1.2",
    "5.1.2.rc1",
    "5.1.3",
    "5.1.3.rc1",
    "5.1.3.rc2",
    "5.1.3.rc3",
    "5.1.4",
    "5.1.4.rc1",
    "5.1.5",
    "5.1.5.rc1",
    "5.1.6",
    "5.1.6.1",
    "5.1.6.2",
    "5.1.7",
    "5.1.7.rc1",
    "5.2.0",
    "5.2.0.beta1",
    "5.2.0.beta2",
    "5.2.0.rc1",
    "5.2.0.rc2",
    "5.2.1",
    "5.2.1.1",
    "5.2.1.rc1",
    "5.2.2",
    "5.2.2.1",
    "5.2.2.rc1",
    "5.2.3",
    "5.2.3.rc1",
    "5.2.4",
    "5.2.4.1",
    "5.2.4.2",
    "5.2.4.3",
    "5.2.4.4",
    "5.2.4.5",
    "5.2.4.6",
    "5.2.4.rc1",
    "5.2.5",
    "5.2.6",
    "5.2.6.1",
    "5.2.6.2",
    "5.2.6.3",
    "5.2.7",
    "5.2.7.1",
    "5.2.8",
    "5.2.8.1",
    "6.0.0",
    "6.0.0.beta1",
    "6.0.0.beta2",
    "6.0.0.beta3",
    "6.0.0.rc1",
    "6.0.0.rc2",
    "6.0.1",
    "6.0.1.rc1",
    "6.0.2",
    "6.0.2.1",
    "6.0.2.2",
    "6.0.2.rc1",
    "6.0.2.rc2",
    "6.0.3",
    "6.0.3.1",
    "6.0.3.2",
    "6.0.3.3",
    "6.0.3.4",
    "6.0.3.5",
    "6.0.3.6",
    "6.0.3.7",
    "6.0.3.rc1",
    "6.0.4",
    "6.0.4.1",
    "6.0.4.2",
    "6.0.4.3",
    "6.0.4.4",
    "6.0.4.5",
    "6.0.4.6",
    "6.0.4.7",
    "6.0.4.8",
    "6.0.5",
    "6.0.5.1",
    "6.0.6",
    "6.0.6.1",
    "6.1.0",
    "6.1.0.rc1",
    "6.1.0.rc2",
    "6.1.1",
    "6.1.2",
    "6.1.2.1",
    "6.1.3",
    "6.1.3.1",
    "6.1.3.2",
    "6.1.4",
    "6.1.4.1",
    "6.1.4.2",
    "6.1.4.3",
    "6.1.4.4",
    "6.1.4.5",
    "6.1.4.6",
    "6.1.4.7",
    "6.1.5",
    "6.1.5.1",
    "6.1.6",
    "6.1.6.1",
    "6.1.7",
    "6.1.7.1",
    "6.1.7.10",
    "6.1.7.2",
    "6.1.7.3",
    "6.1.7.4",
    "6.1.7.5",
    "6.1.7.6",
    "6.1.7.7",
    "6.1.7.8",
    "6.1.7.9",
    "7.0.0",
    "7.0.0.alpha1",
    "7.0.0.alpha2",
    "7.0.0.rc1",
    "7.0.0.rc2",
    "7.0.0.rc3",
    "7.0.1",
    "7.0.10",
    "7.0.2",
    "7.0.2.1",
    "7.0.2.2",
    "7.0.2.3",
    "7.0.2.4",
    "7.0.3",
    "7.0.3.1",
    "7.0.4",
    "7.0.4.1",
    "7.0.4.2",
    "7.0.4.3",
    "7.0.5",
    "7.0.5.1",
    "7.0.6",
    "7.0.7",
    "7.0.7.1",
    "7.0.7.2",
    "7.0.8",
    "7.0.8.1",
    "7.0.8.2",
    "7.0.8.3",
    "7.0.8.4",
    "7.0.8.5",
    "7.0.8.6",
    "7.0.8.7",
    "7.1.0",
    "7.1.0.beta1",
    "7.1.0.rc1",
    "7.1.0.rc2",
    "7.1.1",
    "7.1.2",
    "7.1.3",
    "7.1.3.1",
    "7.1.3.2",
    "7.1.3.3",
    "7.1.3.4",
    "7.1.4",
    "7.1.4.1",
    "7.1.4.2",
    "7.1.5",
    "7.1.5.1",
    "7.1.5.2",
    "7.1.6",
    "7.2.0",
    "7.2.0.beta1",
    "7.2.0.beta2",
    "7.2.0.beta3",
    "7.2.0.rc1",
    "7.2.1",
    "7.2.1.1",
    "7.2.1.2",
    "7.2.2",
    "7.2.2.1",
    "7.2.2.2",
    "7.2.3",
    "7.2.3.1",
    "7.2.3.2",
    "7.2.4",
    "8.0.0",
    "8.0.0.1",
    "8.0.0.beta1",
    "8.0.0.rc1",
    "8.0.0.rc2",
    "8.0.1",
    "8.0.2",
    "8.0.2.1",
    "8.0.3",
    "8.0.4",
    "8.0.4.1",
    "8.0.5",
    "8.0.5.1"
  ]
}
medium4.2
GHSA-2586-8ghr-69fjPackage fixes recorded

Action Pack: Possible restoration of destroyed sessions in Action Dispatch CacheStore

ActionDispatch::Session::CacheStore writes a session back to the cache at the end of each request that loaded it, without checking that the session's cache entry still exists. When a concurrent request destroys the session, through reset_session on logout or by deleting its cache entry on the server, a request that loaded the session earlier and finishes later restores it under its original session ID. Logout and server-side revocation could therefore fail to end a session, and an attacker who holds a stolen session cookie could keep that session valid across the victim's logout.

Recorded fixes — actionpack: 8.1.4.1 or 8.0.5.2. Check your release branch.

Exploitation not established

RubyGems / actionpack
actionpack RubyGems
Affected range Recorded fix
From 8.1.0.beta1 before 8.1.4.1Ecosystem versions8.1.4.1

Version evidence: OSV · GHSA-2586-8ghr-69fj

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "8.1.0.beta1"
        },
        {
          "fixed": "8.1.4.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "8.1.0",
    "8.1.0.beta1",
    "8.1.0.rc1",
    "8.1.1",
    "8.1.2",
    "8.1.2.1",
    "8.1.3",
    "8.1.3.1",
    "8.1.4"
  ]
}
actionpack RubyGems
Affected range Recorded fix
Earlier releases before 8.0.5.2Ecosystem versions8.0.5.2

Version evidence: OSV · GHSA-2586-8ghr-69fj

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "8.0.5.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.9.0",
    "0.9.5",
    "1.0.0",
    "1.0.1",
    "1.1.0",
    "1.10.1",
    "1.10.2",
    "1.11.0",
    "1.11.1",
    "1.11.2",
    "1.12.0",
    "1.12.1",
    "1.12.2",
    "1.12.3",
    "1.12.4",
    "1.12.5",
    "1.13.0",
    "1.13.1",
    "1.13.2",
    "1.13.3",
    "1.13.4",
    "1.13.5",
    "1.13.6",
    "1.2.0",
    "1.3.0",
    "1.3.1",
    "1.4.0",
    "1.5.0",
    "1.5.1",
    "1.6.0",
    "1.7.0",
    "1.8.0",
    "1.8.1",
    "1.9.0",
    "1.9.1",
    "2.0.0",
    "2.0.1",
    "2.0.2",
    "2.0.4",
    "2.0.5",
    "2.1.0",
    "2.1.1",
    "2.1.2",
    "2.2.2",
    "2.2.3",
    "2.3.10",
    "2.3.11",
    "2.3.12",
    "2.3.14",
    "2.3.15",
    "2.3.16",
    "2.3.17",
    "2.3.18",
    "2.3.2",
    "2.3.3",
    "2.3.4",
    "2.3.5",
    "2.3.6",
    "2.3.7",
    "2.3.8",
    "2.3.8.pre1",
    "2.3.9",
    "2.3.9.pre",
    "3.0.0",
    "3.0.0.beta",
    "3.0.0.beta2",
    "3.0.0.beta3",
    "3.0.0.beta4",
    "3.0.0.rc",
    "3.0.0.rc2",
    "3.0.1",
    "3.0.10",
    "3.0.10.rc1",
    "3.0.11",
    "3.0.12",
    "3.0.12.rc1",
    "3.0.13",
    "3.0.13.rc1",
    "3.0.14",
    "3.0.15",
    "3.0.16",
    "3.0.17",
    "3.0.18",
    "3.0.19",
    "3.0.2",
    "3.0.20",
    "3.0.3",
    "3.0.4",
    "3.0.4.rc1",
    "3.0.5",
    "3.0.5.rc1",
    "3.0.6",
    "3.0.6.rc1",
    "3.0.6.rc2",
    "3.0.7",
    "3.0.7.rc1",
    "3.0.7.rc2",
    "3.0.8",
    "3.0.8.rc1",
    "3.0.8.rc2",
    "3.0.8.rc4",
    "3.0.9",
    "3.0.9.rc1",
    "3.0.9.rc3",
    "3.0.9.rc4",
    "3.0.9.rc5",
    "3.1.0",
    "3.1.0.beta1",
    "3.1.0.rc1",
    "3.1.0.rc2",
    "3.1.0.rc3",
    "3.1.0.rc4",
    "3.1.0.rc5",
    "3.1.0.rc6",
    "3.1.0.rc8",
    "3.1.1",
    "3.1.1.rc1",
    "3.1.1.rc2",
    "3.1.1.rc3",
    "3.1.10",
    "3.1.11",
    "3.1.12",
    "3.1.2",
    "3.1.2.rc1",
    "3.1.2.rc2",
    "3.1.3",
    "3.1.4",
    "3.1.4.rc1",
    "3.1.5",
    "3.1.5.rc1",
    "3.1.6",
    "3.1.7",
    "3.1.8",
    "3.1.9",
    "3.2.0",
    "3.2.0.rc1",
    "3.2.0.rc2",
    "3.2.1",
    "3.2.10",
    "3.2.11",
    "3.2.12",
    "3.2.13",
    "3.2.13.rc1",
    "3.2.13.rc2",
    "3.2.14",
    "3.2.14.rc1",
    "3.2.14.rc2",
    "3.2.15",
    "3.2.15.rc1",
    "3.2.15.rc2",
    "3.2.15.rc3",
    "3.2.16",
    "3.2.17",
    "3.2.18",
    "3.2.19",
    "3.2.2",
    "3.2.2.rc1",
    "3.2.20",
    "3.2.21",
    "3.2.22",
    "3.2.22.1",
    "3.2.22.2",
    "3.2.22.3",
    "3.2.22.4",
    "3.2.22.5",
    "3.2.3",
    "3.2.3.rc1",
    "3.2.3.rc2",
    "3.2.4",
    "3.2.4.rc1",
    "3.2.5",
    "3.2.6",
    "3.2.7",
    "3.2.7.rc1",
    "3.2.8",
    "3.2.8.rc1",
    "3.2.8.rc2",
    "3.2.9",
    "3.2.9.rc1",
    "3.2.9.rc2",
    "3.2.9.rc3",
    "4.0.0",
    "4.0.0.beta1",
    "4.0.0.rc1",
    "4.0.0.rc2",
    "4.0.1",
    "4.0.1.rc1",
    "4.0.1.rc2",
    "4.0.1.rc3",
    "4.0.1.rc4",
    "4.0.10",
    "4.0.10.rc1",
    "4.0.10.rc2",
    "4.0.11",
    "4.0.11.1",
    "4.0.12",
    "4.0.13",
    "4.0.13.rc1",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.4.rc1",
    "4.0.5",
    "4.0.6",
    "4.0.6.rc1",
    "4.0.6.rc2",
    "4.0.6.rc3",
    "4.0.7",
    "4.0.8",
    "4.0.9",
    "4.1.0",
    "4.1.0.beta1",
    "4.1.0.beta2",
    "4.1.0.rc1",
    "4.1.0.rc2",
    "4.1.1",
    "4.1.10",
    "4.1.10.rc1",
    "4.1.10.rc2",
    "4.1.10.rc3",
    "4.1.10.rc4",
    "4.1.11",
    "4.1.12",
    "4.1.12.rc1",
    "4.1.13",
    "4.1.13.rc1",
    "4.1.14",
    "4.1.14.1",
    "4.1.14.2",
    "4.1.14.rc1",
    "4.1.14.rc2",
    "4.1.15",
    "4.1.15.rc1",
    "4.1.16",
    "4.1.16.rc1",
    "4.1.2",
    "4.1.2.rc1",
    "4.1.2.rc2",
    "4.1.2.rc3",
    "4.1.3",
    "4.1.4",
    "4.1.5",
    "4.1.6",
    "4.1.6.rc1",
    "4.1.6.rc2",
    "4.1.7",
    "4.1.7.1",
    "4.1.8",
    "4.1.9",
    "4.1.9.rc1",
    "4.2.0",
    "4.2.0.beta1",
    "4.2.0.beta2",
    "4.2.0.beta3",
    "4.2.0.beta4",
    "4.2.0.rc1",
    "4.2.0.rc2",
    "4.2.0.rc3",
    "4.2.1",
    "4.2.1.rc1",
    "4.2.1.rc2",
    "4.2.1.rc3",
    "4.2.1.rc4",
    "4.2.10",
    "4.2.10.rc1",
    "4.2.11",
    "4.2.11.1",
    "4.2.11.2",
    "4.2.11.3",
    "4.2.2",
    "4.2.3",
    "4.2.3.rc1",
    "4.2.4",
    "4.2.4.rc1",
    "4.2.5",
    "4.2.5.1",
    "4.2.5.2",
    "4.2.5.rc1",
    "4.2.5.rc2",
    "4.2.6",
    "4.2.6.rc1",
    "4.2.7",
    "4.2.7.1",
    "4.2.7.rc1",
    "4.2.8",
    "4.2.8.rc1",
    "4.2.9",
    "4.2.9.rc1",
    "4.2.9.rc2",
    "5.0.0",
    "5.0.0.1",
    "5.0.0.beta1",
    "5.0.0.beta1.1",
    "5.0.0.beta2",
    "5.0.0.beta3",
    "5.0.0.beta4",
    "5.0.0.racecar1",
    "5.0.0.rc1",
    "5.0.0.rc2",
    "5.0.1",
    "5.0.1.rc1",
    "5.0.1.rc2",
    "5.0.2",
    "5.0.2.rc1",
    "5.0.3",
    "5.0.4",
    "5.0.4.rc1",
    "5.0.5",
    "5.0.5.rc1",
    "5.0.5.rc2",
    "5.0.6",
    "5.0.6.rc1",
    "5.0.7",
    "5.0.7.1",
    "5.0.7.2",
    "5.1.0",
    "5.1.0.beta1",
    "5.1.0.rc1",
    "5.1.0.rc2",
    "5.1.1",
    "5.1.2",
    "5.1.2.rc1",
    "5.1.3",
    "5.1.3.rc1",
    "5.1.3.rc2",
    "5.1.3.rc3",
    "5.1.4",
    "5.1.4.rc1",
    "5.1.5",
    "5.1.5.rc1",
    "5.1.6",
    "5.1.6.1",
    "5.1.6.2",
    "5.1.7",
    "5.1.7.rc1",
    "5.2.0",
    "5.2.0.beta1",
    "5.2.0.beta2",
    "5.2.0.rc1",
    "5.2.0.rc2",
    "5.2.1",
    "5.2.1.1",
    "5.2.1.rc1",
    "5.2.2",
    "5.2.2.1",
    "5.2.2.rc1",
    "5.2.3",
    "5.2.3.rc1",
    "5.2.4",
    "5.2.4.1",
    "5.2.4.2",
    "5.2.4.3",
    "5.2.4.4",
    "5.2.4.5",
    "5.2.4.6",
    "5.2.4.rc1",
    "5.2.5",
    "5.2.6",
    "5.2.6.1",
    "5.2.6.2",
    "5.2.6.3",
    "5.2.7",
    "5.2.7.1",
    "5.2.8",
    "5.2.8.1",
    "6.0.0",
    "6.0.0.beta1",
    "6.0.0.beta2",
    "6.0.0.beta3",
    "6.0.0.rc1",
    "6.0.0.rc2",
    "6.0.1",
    "6.0.1.rc1",
    "6.0.2",
    "6.0.2.1",
    "6.0.2.2",
    "6.0.2.rc1",
    "6.0.2.rc2",
    "6.0.3",
    "6.0.3.1",
    "6.0.3.2",
    "6.0.3.3",
    "6.0.3.4",
    "6.0.3.5",
    "6.0.3.6",
    "6.0.3.7",
    "6.0.3.rc1",
    "6.0.4",
    "6.0.4.1",
    "6.0.4.2",
    "6.0.4.3",
    "6.0.4.4",
    "6.0.4.5",
    "6.0.4.6",
    "6.0.4.7",
    "6.0.4.8",
    "6.0.5",
    "6.0.5.1",
    "6.0.6",
    "6.0.6.1",
    "6.1.0",
    "6.1.0.rc1",
    "6.1.0.rc2",
    "6.1.1",
    "6.1.2",
    "6.1.2.1",
    "6.1.3",
    "6.1.3.1",
    "6.1.3.2",
    "6.1.4",
    "6.1.4.1",
    "6.1.4.2",
    "6.1.4.3",
    "6.1.4.4",
    "6.1.4.5",
    "6.1.4.6",
    "6.1.4.7",
    "6.1.5",
    "6.1.5.1",
    "6.1.6",
    "6.1.6.1",
    "6.1.7",
    "6.1.7.1",
    "6.1.7.10",
    "6.1.7.2",
    "6.1.7.3",
    "6.1.7.4",
    "6.1.7.5",
    "6.1.7.6",
    "6.1.7.7",
    "6.1.7.8",
    "6.1.7.9",
    "7.0.0",
    "7.0.0.alpha1",
    "7.0.0.alpha2",
    "7.0.0.rc1",
    "7.0.0.rc2",
    "7.0.0.rc3",
    "7.0.1",
    "7.0.10",
    "7.0.2",
    "7.0.2.1",
    "7.0.2.2",
    "7.0.2.3",
    "7.0.2.4",
    "7.0.3",
    "7.0.3.1",
    "7.0.4",
    "7.0.4.1",
    "7.0.4.2",
    "7.0.4.3",
    "7.0.5",
    "7.0.5.1",
    "7.0.6",
    "7.0.7",
    "7.0.7.1",
    "7.0.7.2",
    "7.0.8",
    "7.0.8.1",
    "7.0.8.2",
    "7.0.8.3",
    "7.0.8.4",
    "7.0.8.5",
    "7.0.8.6",
    "7.0.8.7",
    "7.1.0",
    "7.1.0.beta1",
    "7.1.0.rc1",
    "7.1.0.rc2",
    "7.1.1",
    "7.1.2",
    "7.1.3",
    "7.1.3.1",
    "7.1.3.2",
    "7.1.3.3",
    "7.1.3.4",
    "7.1.4",
    "7.1.4.1",
    "7.1.4.2",
    "7.1.5",
    "7.1.5.1",
    "7.1.5.2",
    "7.1.6",
    "7.2.0",
    "7.2.0.beta1",
    "7.2.0.beta2",
    "7.2.0.beta3",
    "7.2.0.rc1",
    "7.2.1",
    "7.2.1.1",
    "7.2.1.2",
    "7.2.2",
    "7.2.2.1",
    "7.2.2.2",
    "7.2.3",
    "7.2.3.1",
    "7.2.3.2",
    "7.2.4",
    "8.0.0",
    "8.0.0.1",
    "8.0.0.beta1",
    "8.0.0.rc1",
    "8.0.0.rc2",
    "8.0.1",
    "8.0.2",
    "8.0.2.1",
    "8.0.3",
    "8.0.4",
    "8.0.4.1",
    "8.0.5",
    "8.0.5.1"
  ]
}
medium4.8
CVE-2026-126073Package fixes recorded

Action Pack: Possible cache poisoning in Action Pack content negotiation

Action Pack negotiates the format of a rendered response from the Accept, X-Requested-With and, for XHR requests without Accept, Content-Type request headers, but ActionController::Rendering#_set_vary_header adds Vary: Accept only when the request carries a usable Accept header and the response has no Vary header yet. A response to a request without Accept, or to an XHR request, therefore omits the headers that selected its representation, and a response whose Vary the application set before rendering (for example Vary: Accept-Language) never gains Accept. A shared cache that honours Vary could store such a response and serve it to later clients that request a different representation, possibly leading to cache poisoning in which visitors receive, until the entry expires, a page without its layout or HTML in place of JSON. The attacker cannot choose the content of the response.

Recorded fixes — actionpack: 8.1.4.1 or 8.0.5.2. Check your release branch.

Exploitation not established

RubyGems / actionpack
actionpack RubyGems
Affected range Recorded fix
From 8.1 before 8.1.4.1Ecosystem versions8.1.4.1

Version evidence: OSV · GHSA-r9jg-fmfx-2gv6

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "8.1"
        },
        {
          "fixed": "8.1.4.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "8.1.0",
    "8.1.1",
    "8.1.2",
    "8.1.2.1",
    "8.1.3",
    "8.1.3.1",
    "8.1.4"
  ]
}
actionpack RubyGems
Affected range Recorded fix
Earlier releases before 8.0.5.2Ecosystem versions8.0.5.2

Version evidence: OSV · GHSA-r9jg-fmfx-2gv6

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "8.0.5.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.9.0",
    "0.9.5",
    "1.0.0",
    "1.0.1",
    "1.1.0",
    "1.10.1",
    "1.10.2",
    "1.11.0",
    "1.11.1",
    "1.11.2",
    "1.12.0",
    "1.12.1",
    "1.12.2",
    "1.12.3",
    "1.12.4",
    "1.12.5",
    "1.13.0",
    "1.13.1",
    "1.13.2",
    "1.13.3",
    "1.13.4",
    "1.13.5",
    "1.13.6",
    "1.2.0",
    "1.3.0",
    "1.3.1",
    "1.4.0",
    "1.5.0",
    "1.5.1",
    "1.6.0",
    "1.7.0",
    "1.8.0",
    "1.8.1",
    "1.9.0",
    "1.9.1",
    "2.0.0",
    "2.0.1",
    "2.0.2",
    "2.0.4",
    "2.0.5",
    "2.1.0",
    "2.1.1",
    "2.1.2",
    "2.2.2",
    "2.2.3",
    "2.3.10",
    "2.3.11",
    "2.3.12",
    "2.3.14",
    "2.3.15",
    "2.3.16",
    "2.3.17",
    "2.3.18",
    "2.3.2",
    "2.3.3",
    "2.3.4",
    "2.3.5",
    "2.3.6",
    "2.3.7",
    "2.3.8",
    "2.3.8.pre1",
    "2.3.9",
    "2.3.9.pre",
    "3.0.0",
    "3.0.0.beta",
    "3.0.0.beta2",
    "3.0.0.beta3",
    "3.0.0.beta4",
    "3.0.0.rc",
    "3.0.0.rc2",
    "3.0.1",
    "3.0.10",
    "3.0.10.rc1",
    "3.0.11",
    "3.0.12",
    "3.0.12.rc1",
    "3.0.13",
    "3.0.13.rc1",
    "3.0.14",
    "3.0.15",
    "3.0.16",
    "3.0.17",
    "3.0.18",
    "3.0.19",
    "3.0.2",
    "3.0.20",
    "3.0.3",
    "3.0.4",
    "3.0.4.rc1",
    "3.0.5",
    "3.0.5.rc1",
    "3.0.6",
    "3.0.6.rc1",
    "3.0.6.rc2",
    "3.0.7",
    "3.0.7.rc1",
    "3.0.7.rc2",
    "3.0.8",
    "3.0.8.rc1",
    "3.0.8.rc2",
    "3.0.8.rc4",
    "3.0.9",
    "3.0.9.rc1",
    "3.0.9.rc3",
    "3.0.9.rc4",
    "3.0.9.rc5",
    "3.1.0",
    "3.1.0.beta1",
    "3.1.0.rc1",
    "3.1.0.rc2",
    "3.1.0.rc3",
    "3.1.0.rc4",
    "3.1.0.rc5",
    "3.1.0.rc6",
    "3.1.0.rc8",
    "3.1.1",
    "3.1.1.rc1",
    "3.1.1.rc2",
    "3.1.1.rc3",
    "3.1.10",
    "3.1.11",
    "3.1.12",
    "3.1.2",
    "3.1.2.rc1",
    "3.1.2.rc2",
    "3.1.3",
    "3.1.4",
    "3.1.4.rc1",
    "3.1.5",
    "3.1.5.rc1",
    "3.1.6",
    "3.1.7",
    "3.1.8",
    "3.1.9",
    "3.2.0",
    "3.2.0.rc1",
    "3.2.0.rc2",
    "3.2.1",
    "3.2.10",
    "3.2.11",
    "3.2.12",
    "3.2.13",
    "3.2.13.rc1",
    "3.2.13.rc2",
    "3.2.14",
    "3.2.14.rc1",
    "3.2.14.rc2",
    "3.2.15",
    "3.2.15.rc1",
    "3.2.15.rc2",
    "3.2.15.rc3",
    "3.2.16",
    "3.2.17",
    "3.2.18",
    "3.2.19",
    "3.2.2",
    "3.2.2.rc1",
    "3.2.20",
    "3.2.21",
    "3.2.22",
    "3.2.22.1",
    "3.2.22.2",
    "3.2.22.3",
    "3.2.22.4",
    "3.2.22.5",
    "3.2.3",
    "3.2.3.rc1",
    "3.2.3.rc2",
    "3.2.4",
    "3.2.4.rc1",
    "3.2.5",
    "3.2.6",
    "3.2.7",
    "3.2.7.rc1",
    "3.2.8",
    "3.2.8.rc1",
    "3.2.8.rc2",
    "3.2.9",
    "3.2.9.rc1",
    "3.2.9.rc2",
    "3.2.9.rc3",
    "4.0.0",
    "4.0.0.beta1",
    "4.0.0.rc1",
    "4.0.0.rc2",
    "4.0.1",
    "4.0.1.rc1",
    "4.0.1.rc2",
    "4.0.1.rc3",
    "4.0.1.rc4",
    "4.0.10",
    "4.0.10.rc1",
    "4.0.10.rc2",
    "4.0.11",
    "4.0.11.1",
    "4.0.12",
    "4.0.13",
    "4.0.13.rc1",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.4.rc1",
    "4.0.5",
    "4.0.6",
    "4.0.6.rc1",
    "4.0.6.rc2",
    "4.0.6.rc3",
    "4.0.7",
    "4.0.8",
    "4.0.9",
    "4.1.0",
    "4.1.0.beta1",
    "4.1.0.beta2",
    "4.1.0.rc1",
    "4.1.0.rc2",
    "4.1.1",
    "4.1.10",
    "4.1.10.rc1",
    "4.1.10.rc2",
    "4.1.10.rc3",
    "4.1.10.rc4",
    "4.1.11",
    "4.1.12",
    "4.1.12.rc1",
    "4.1.13",
    "4.1.13.rc1",
    "4.1.14",
    "4.1.14.1",
    "4.1.14.2",
    "4.1.14.rc1",
    "4.1.14.rc2",
    "4.1.15",
    "4.1.15.rc1",
    "4.1.16",
    "4.1.16.rc1",
    "4.1.2",
    "4.1.2.rc1",
    "4.1.2.rc2",
    "4.1.2.rc3",
    "4.1.3",
    "4.1.4",
    "4.1.5",
    "4.1.6",
    "4.1.6.rc1",
    "4.1.6.rc2",
    "4.1.7",
    "4.1.7.1",
    "4.1.8",
    "4.1.9",
    "4.1.9.rc1",
    "4.2.0",
    "4.2.0.beta1",
    "4.2.0.beta2",
    "4.2.0.beta3",
    "4.2.0.beta4",
    "4.2.0.rc1",
    "4.2.0.rc2",
    "4.2.0.rc3",
    "4.2.1",
    "4.2.1.rc1",
    "4.2.1.rc2",
    "4.2.1.rc3",
    "4.2.1.rc4",
    "4.2.10",
    "4.2.10.rc1",
    "4.2.11",
    "4.2.11.1",
    "4.2.11.2",
    "4.2.11.3",
    "4.2.2",
    "4.2.3",
    "4.2.3.rc1",
    "4.2.4",
    "4.2.4.rc1",
    "4.2.5",
    "4.2.5.1",
    "4.2.5.2",
    "4.2.5.rc1",
    "4.2.5.rc2",
    "4.2.6",
    "4.2.6.rc1",
    "4.2.7",
    "4.2.7.1",
    "4.2.7.rc1",
    "4.2.8",
    "4.2.8.rc1",
    "4.2.9",
    "4.2.9.rc1",
    "4.2.9.rc2",
    "5.0.0",
    "5.0.0.1",
    "5.0.0.beta1",
    "5.0.0.beta1.1",
    "5.0.0.beta2",
    "5.0.0.beta3",
    "5.0.0.beta4",
    "5.0.0.racecar1",
    "5.0.0.rc1",
    "5.0.0.rc2",
    "5.0.1",
    "5.0.1.rc1",
    "5.0.1.rc2",
    "5.0.2",
    "5.0.2.rc1",
    "5.0.3",
    "5.0.4",
    "5.0.4.rc1",
    "5.0.5",
    "5.0.5.rc1",
    "5.0.5.rc2",
    "5.0.6",
    "5.0.6.rc1",
    "5.0.7",
    "5.0.7.1",
    "5.0.7.2",
    "5.1.0",
    "5.1.0.beta1",
    "5.1.0.rc1",
    "5.1.0.rc2",
    "5.1.1",
    "5.1.2",
    "5.1.2.rc1",
    "5.1.3",
    "5.1.3.rc1",
    "5.1.3.rc2",
    "5.1.3.rc3",
    "5.1.4",
    "5.1.4.rc1",
    "5.1.5",
    "5.1.5.rc1",
    "5.1.6",
    "5.1.6.1",
    "5.1.6.2",
    "5.1.7",
    "5.1.7.rc1",
    "5.2.0",
    "5.2.0.beta1",
    "5.2.0.beta2",
    "5.2.0.rc1",
    "5.2.0.rc2",
    "5.2.1",
    "5.2.1.1",
    "5.2.1.rc1",
    "5.2.2",
    "5.2.2.1",
    "5.2.2.rc1",
    "5.2.3",
    "5.2.3.rc1",
    "5.2.4",
    "5.2.4.1",
    "5.2.4.2",
    "5.2.4.3",
    "5.2.4.4",
    "5.2.4.5",
    "5.2.4.6",
    "5.2.4.rc1",
    "5.2.5",
    "5.2.6",
    "5.2.6.1",
    "5.2.6.2",
    "5.2.6.3",
    "5.2.7",
    "5.2.7.1",
    "5.2.8",
    "5.2.8.1",
    "6.0.0",
    "6.0.0.beta1",
    "6.0.0.beta2",
    "6.0.0.beta3",
    "6.0.0.rc1",
    "6.0.0.rc2",
    "6.0.1",
    "6.0.1.rc1",
    "6.0.2",
    "6.0.2.1",
    "6.0.2.2",
    "6.0.2.rc1",
    "6.0.2.rc2",
    "6.0.3",
    "6.0.3.1",
    "6.0.3.2",
    "6.0.3.3",
    "6.0.3.4",
    "6.0.3.5",
    "6.0.3.6",
    "6.0.3.7",
    "6.0.3.rc1",
    "6.0.4",
    "6.0.4.1",
    "6.0.4.2",
    "6.0.4.3",
    "6.0.4.4",
    "6.0.4.5",
    "6.0.4.6",
    "6.0.4.7",
    "6.0.4.8",
    "6.0.5",
    "6.0.5.1",
    "6.0.6",
    "6.0.6.1",
    "6.1.0",
    "6.1.0.rc1",
    "6.1.0.rc2",
    "6.1.1",
    "6.1.2",
    "6.1.2.1",
    "6.1.3",
    "6.1.3.1",
    "6.1.3.2",
    "6.1.4",
    "6.1.4.1",
    "6.1.4.2",
    "6.1.4.3",
    "6.1.4.4",
    "6.1.4.5",
    "6.1.4.6",
    "6.1.4.7",
    "6.1.5",
    "6.1.5.1",
    "6.1.6",
    "6.1.6.1",
    "6.1.7",
    "6.1.7.1",
    "6.1.7.10",
    "6.1.7.2",
    "6.1.7.3",
    "6.1.7.4",
    "6.1.7.5",
    "6.1.7.6",
    "6.1.7.7",
    "6.1.7.8",
    "6.1.7.9",
    "7.0.0",
    "7.0.0.alpha1",
    "7.0.0.alpha2",
    "7.0.0.rc1",
    "7.0.0.rc2",
    "7.0.0.rc3",
    "7.0.1",
    "7.0.10",
    "7.0.2",
    "7.0.2.1",
    "7.0.2.2",
    "7.0.2.3",
    "7.0.2.4",
    "7.0.3",
    "7.0.3.1",
    "7.0.4",
    "7.0.4.1",
    "7.0.4.2",
    "7.0.4.3",
    "7.0.5",
    "7.0.5.1",
    "7.0.6",
    "7.0.7",
    "7.0.7.1",
    "7.0.7.2",
    "7.0.8",
    "7.0.8.1",
    "7.0.8.2",
    "7.0.8.3",
    "7.0.8.4",
    "7.0.8.5",
    "7.0.8.6",
    "7.0.8.7",
    "7.1.0",
    "7.1.0.beta1",
    "7.1.0.rc1",
    "7.1.0.rc2",
    "7.1.1",
    "7.1.2",
    "7.1.3",
    "7.1.3.1",
    "7.1.3.2",
    "7.1.3.3",
    "7.1.3.4",
    "7.1.4",
    "7.1.4.1",
    "7.1.4.2",
    "7.1.5",
    "7.1.5.1",
    "7.1.5.2",
    "7.1.6",
    "7.2.0",
    "7.2.0.beta1",
    "7.2.0.beta2",
    "7.2.0.beta3",
    "7.2.0.rc1",
    "7.2.1",
    "7.2.1.1",
    "7.2.1.2",
    "7.2.2",
    "7.2.2.1",
    "7.2.2.2",
    "7.2.3",
    "7.2.3.1",
    "7.2.3.2",
    "7.2.4",
    "8.0.0",
    "8.0.0.1",
    "8.0.0.beta1",
    "8.0.0.rc1",
    "8.0.0.rc2",
    "8.0.1",
    "8.0.2",
    "8.0.2.1",
    "8.0.3",
    "8.0.4",
    "8.0.4.1",
    "8.0.5",
    "8.0.5.1"
  ]
}
medium5.9
CVE-2026-126072Package fixes recorded

Action Pack: Possible DoS vulnerability in Action Controller Live streaming

ActionController::Live::Buffer#close pushes its end-of-stream marker onto the response's bounded queue while it holds the buffer's monitor. When the client has stopped reading and the queue is full, the push blocks, and Buffer#abort, which runs when the client disconnects or a write times out, waits indefinitely for the same monitor. Each such response could permanently hold a web server thread and its ActionController::Live thread, possibly resulting in a DoS vulnerability through thread exhaustion.

Recorded fixes — actionpack: 8.1.4.1 or 8.0.5.2. Check your release branch.

Exploitation not established

RubyGems / actionpack
actionpack RubyGems
Affected range Recorded fix
From 8.1.0.beta1 before 8.1.4.1Ecosystem versions8.1.4.1

Version evidence: OSV · GHSA-rwvh-fw6r-pwvp

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "8.1.0.beta1"
        },
        {
          "fixed": "8.1.4.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "8.1.0",
    "8.1.0.beta1",
    "8.1.0.rc1",
    "8.1.1",
    "8.1.2",
    "8.1.2.1",
    "8.1.3",
    "8.1.3.1",
    "8.1.4"
  ]
}
actionpack RubyGems
Affected range Recorded fix
Earlier releases before 8.0.5.2Ecosystem versions8.0.5.2

Version evidence: OSV · GHSA-rwvh-fw6r-pwvp

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "8.0.5.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.9.0",
    "0.9.5",
    "1.0.0",
    "1.0.1",
    "1.1.0",
    "1.10.1",
    "1.10.2",
    "1.11.0",
    "1.11.1",
    "1.11.2",
    "1.12.0",
    "1.12.1",
    "1.12.2",
    "1.12.3",
    "1.12.4",
    "1.12.5",
    "1.13.0",
    "1.13.1",
    "1.13.2",
    "1.13.3",
    "1.13.4",
    "1.13.5",
    "1.13.6",
    "1.2.0",
    "1.3.0",
    "1.3.1",
    "1.4.0",
    "1.5.0",
    "1.5.1",
    "1.6.0",
    "1.7.0",
    "1.8.0",
    "1.8.1",
    "1.9.0",
    "1.9.1",
    "2.0.0",
    "2.0.1",
    "2.0.2",
    "2.0.4",
    "2.0.5",
    "2.1.0",
    "2.1.1",
    "2.1.2",
    "2.2.2",
    "2.2.3",
    "2.3.10",
    "2.3.11",
    "2.3.12",
    "2.3.14",
    "2.3.15",
    "2.3.16",
    "2.3.17",
    "2.3.18",
    "2.3.2",
    "2.3.3",
    "2.3.4",
    "2.3.5",
    "2.3.6",
    "2.3.7",
    "2.3.8",
    "2.3.8.pre1",
    "2.3.9",
    "2.3.9.pre",
    "3.0.0",
    "3.0.0.beta",
    "3.0.0.beta2",
    "3.0.0.beta3",
    "3.0.0.beta4",
    "3.0.0.rc",
    "3.0.0.rc2",
    "3.0.1",
    "3.0.10",
    "3.0.10.rc1",
    "3.0.11",
    "3.0.12",
    "3.0.12.rc1",
    "3.0.13",
    "3.0.13.rc1",
    "3.0.14",
    "3.0.15",
    "3.0.16",
    "3.0.17",
    "3.0.18",
    "3.0.19",
    "3.0.2",
    "3.0.20",
    "3.0.3",
    "3.0.4",
    "3.0.4.rc1",
    "3.0.5",
    "3.0.5.rc1",
    "3.0.6",
    "3.0.6.rc1",
    "3.0.6.rc2",
    "3.0.7",
    "3.0.7.rc1",
    "3.0.7.rc2",
    "3.0.8",
    "3.0.8.rc1",
    "3.0.8.rc2",
    "3.0.8.rc4",
    "3.0.9",
    "3.0.9.rc1",
    "3.0.9.rc3",
    "3.0.9.rc4",
    "3.0.9.rc5",
    "3.1.0",
    "3.1.0.beta1",
    "3.1.0.rc1",
    "3.1.0.rc2",
    "3.1.0.rc3",
    "3.1.0.rc4",
    "3.1.0.rc5",
    "3.1.0.rc6",
    "3.1.0.rc8",
    "3.1.1",
    "3.1.1.rc1",
    "3.1.1.rc2",
    "3.1.1.rc3",
    "3.1.10",
    "3.1.11",
    "3.1.12",
    "3.1.2",
    "3.1.2.rc1",
    "3.1.2.rc2",
    "3.1.3",
    "3.1.4",
    "3.1.4.rc1",
    "3.1.5",
    "3.1.5.rc1",
    "3.1.6",
    "3.1.7",
    "3.1.8",
    "3.1.9",
    "3.2.0",
    "3.2.0.rc1",
    "3.2.0.rc2",
    "3.2.1",
    "3.2.10",
    "3.2.11",
    "3.2.12",
    "3.2.13",
    "3.2.13.rc1",
    "3.2.13.rc2",
    "3.2.14",
    "3.2.14.rc1",
    "3.2.14.rc2",
    "3.2.15",
    "3.2.15.rc1",
    "3.2.15.rc2",
    "3.2.15.rc3",
    "3.2.16",
    "3.2.17",
    "3.2.18",
    "3.2.19",
    "3.2.2",
    "3.2.2.rc1",
    "3.2.20",
    "3.2.21",
    "3.2.22",
    "3.2.22.1",
    "3.2.22.2",
    "3.2.22.3",
    "3.2.22.4",
    "3.2.22.5",
    "3.2.3",
    "3.2.3.rc1",
    "3.2.3.rc2",
    "3.2.4",
    "3.2.4.rc1",
    "3.2.5",
    "3.2.6",
    "3.2.7",
    "3.2.7.rc1",
    "3.2.8",
    "3.2.8.rc1",
    "3.2.8.rc2",
    "3.2.9",
    "3.2.9.rc1",
    "3.2.9.rc2",
    "3.2.9.rc3",
    "4.0.0",
    "4.0.0.beta1",
    "4.0.0.rc1",
    "4.0.0.rc2",
    "4.0.1",
    "4.0.1.rc1",
    "4.0.1.rc2",
    "4.0.1.rc3",
    "4.0.1.rc4",
    "4.0.10",
    "4.0.10.rc1",
    "4.0.10.rc2",
    "4.0.11",
    "4.0.11.1",
    "4.0.12",
    "4.0.13",
    "4.0.13.rc1",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.4.rc1",
    "4.0.5",
    "4.0.6",
    "4.0.6.rc1",
    "4.0.6.rc2",
    "4.0.6.rc3",
    "4.0.7",
    "4.0.8",
    "4.0.9",
    "4.1.0",
    "4.1.0.beta1",
    "4.1.0.beta2",
    "4.1.0.rc1",
    "4.1.0.rc2",
    "4.1.1",
    "4.1.10",
    "4.1.10.rc1",
    "4.1.10.rc2",
    "4.1.10.rc3",
    "4.1.10.rc4",
    "4.1.11",
    "4.1.12",
    "4.1.12.rc1",
    "4.1.13",
    "4.1.13.rc1",
    "4.1.14",
    "4.1.14.1",
    "4.1.14.2",
    "4.1.14.rc1",
    "4.1.14.rc2",
    "4.1.15",
    "4.1.15.rc1",
    "4.1.16",
    "4.1.16.rc1",
    "4.1.2",
    "4.1.2.rc1",
    "4.1.2.rc2",
    "4.1.2.rc3",
    "4.1.3",
    "4.1.4",
    "4.1.5",
    "4.1.6",
    "4.1.6.rc1",
    "4.1.6.rc2",
    "4.1.7",
    "4.1.7.1",
    "4.1.8",
    "4.1.9",
    "4.1.9.rc1",
    "4.2.0",
    "4.2.0.beta1",
    "4.2.0.beta2",
    "4.2.0.beta3",
    "4.2.0.beta4",
    "4.2.0.rc1",
    "4.2.0.rc2",
    "4.2.0.rc3",
    "4.2.1",
    "4.2.1.rc1",
    "4.2.1.rc2",
    "4.2.1.rc3",
    "4.2.1.rc4",
    "4.2.10",
    "4.2.10.rc1",
    "4.2.11",
    "4.2.11.1",
    "4.2.11.2",
    "4.2.11.3",
    "4.2.2",
    "4.2.3",
    "4.2.3.rc1",
    "4.2.4",
    "4.2.4.rc1",
    "4.2.5",
    "4.2.5.1",
    "4.2.5.2",
    "4.2.5.rc1",
    "4.2.5.rc2",
    "4.2.6",
    "4.2.6.rc1",
    "4.2.7",
    "4.2.7.1",
    "4.2.7.rc1",
    "4.2.8",
    "4.2.8.rc1",
    "4.2.9",
    "4.2.9.rc1",
    "4.2.9.rc2",
    "5.0.0",
    "5.0.0.1",
    "5.0.0.beta1",
    "5.0.0.beta1.1",
    "5.0.0.beta2",
    "5.0.0.beta3",
    "5.0.0.beta4",
    "5.0.0.racecar1",
    "5.0.0.rc1",
    "5.0.0.rc2",
    "5.0.1",
    "5.0.1.rc1",
    "5.0.1.rc2",
    "5.0.2",
    "5.0.2.rc1",
    "5.0.3",
    "5.0.4",
    "5.0.4.rc1",
    "5.0.5",
    "5.0.5.rc1",
    "5.0.5.rc2",
    "5.0.6",
    "5.0.6.rc1",
    "5.0.7",
    "5.0.7.1",
    "5.0.7.2",
    "5.1.0",
    "5.1.0.beta1",
    "5.1.0.rc1",
    "5.1.0.rc2",
    "5.1.1",
    "5.1.2",
    "5.1.2.rc1",
    "5.1.3",
    "5.1.3.rc1",
    "5.1.3.rc2",
    "5.1.3.rc3",
    "5.1.4",
    "5.1.4.rc1",
    "5.1.5",
    "5.1.5.rc1",
    "5.1.6",
    "5.1.6.1",
    "5.1.6.2",
    "5.1.7",
    "5.1.7.rc1",
    "5.2.0",
    "5.2.0.beta1",
    "5.2.0.beta2",
    "5.2.0.rc1",
    "5.2.0.rc2",
    "5.2.1",
    "5.2.1.1",
    "5.2.1.rc1",
    "5.2.2",
    "5.2.2.1",
    "5.2.2.rc1",
    "5.2.3",
    "5.2.3.rc1",
    "5.2.4",
    "5.2.4.1",
    "5.2.4.2",
    "5.2.4.3",
    "5.2.4.4",
    "5.2.4.5",
    "5.2.4.6",
    "5.2.4.rc1",
    "5.2.5",
    "5.2.6",
    "5.2.6.1",
    "5.2.6.2",
    "5.2.6.3",
    "5.2.7",
    "5.2.7.1",
    "5.2.8",
    "5.2.8.1",
    "6.0.0",
    "6.0.0.beta1",
    "6.0.0.beta2",
    "6.0.0.beta3",
    "6.0.0.rc1",
    "6.0.0.rc2",
    "6.0.1",
    "6.0.1.rc1",
    "6.0.2",
    "6.0.2.1",
    "6.0.2.2",
    "6.0.2.rc1",
    "6.0.2.rc2",
    "6.0.3",
    "6.0.3.1",
    "6.0.3.2",
    "6.0.3.3",
    "6.0.3.4",
    "6.0.3.5",
    "6.0.3.6",
    "6.0.3.7",
    "6.0.3.rc1",
    "6.0.4",
    "6.0.4.1",
    "6.0.4.2",
    "6.0.4.3",
    "6.0.4.4",
    "6.0.4.5",
    "6.0.4.6",
    "6.0.4.7",
    "6.0.4.8",
    "6.0.5",
    "6.0.5.1",
    "6.0.6",
    "6.0.6.1",
    "6.1.0",
    "6.1.0.rc1",
    "6.1.0.rc2",
    "6.1.1",
    "6.1.2",
    "6.1.2.1",
    "6.1.3",
    "6.1.3.1",
    "6.1.3.2",
    "6.1.4",
    "6.1.4.1",
    "6.1.4.2",
    "6.1.4.3",
    "6.1.4.4",
    "6.1.4.5",
    "6.1.4.6",
    "6.1.4.7",
    "6.1.5",
    "6.1.5.1",
    "6.1.6",
    "6.1.6.1",
    "6.1.7",
    "6.1.7.1",
    "6.1.7.10",
    "6.1.7.2",
    "6.1.7.3",
    "6.1.7.4",
    "6.1.7.5",
    "6.1.7.6",
    "6.1.7.7",
    "6.1.7.8",
    "6.1.7.9",
    "7.0.0",
    "7.0.0.alpha1",
    "7.0.0.alpha2",
    "7.0.0.rc1",
    "7.0.0.rc2",
    "7.0.0.rc3",
    "7.0.1",
    "7.0.10",
    "7.0.2",
    "7.0.2.1",
    "7.0.2.2",
    "7.0.2.3",
    "7.0.2.4",
    "7.0.3",
    "7.0.3.1",
    "7.0.4",
    "7.0.4.1",
    "7.0.4.2",
    "7.0.4.3",
    "7.0.5",
    "7.0.5.1",
    "7.0.6",
    "7.0.7",
    "7.0.7.1",
    "7.0.7.2",
    "7.0.8",
    "7.0.8.1",
    "7.0.8.2",
    "7.0.8.3",
    "7.0.8.4",
    "7.0.8.5",
    "7.0.8.6",
    "7.0.8.7",
    "7.1.0",
    "7.1.0.beta1",
    "7.1.0.rc1",
    "7.1.0.rc2",
    "7.1.1",
    "7.1.2",
    "7.1.3",
    "7.1.3.1",
    "7.1.3.2",
    "7.1.3.3",
    "7.1.3.4",
    "7.1.4",
    "7.1.4.1",
    "7.1.4.2",
    "7.1.5",
    "7.1.5.1",
    "7.1.5.2",
    "7.1.6",
    "7.2.0",
    "7.2.0.beta1",
    "7.2.0.beta2",
    "7.2.0.beta3",
    "7.2.0.rc1",
    "7.2.1",
    "7.2.1.1",
    "7.2.1.2",
    "7.2.2",
    "7.2.2.1",
    "7.2.2.2",
    "7.2.3",
    "7.2.3.1",
    "7.2.3.2",
    "7.2.4",
    "8.0.0",
    "8.0.0.1",
    "8.0.0.beta1",
    "8.0.0.rc1",
    "8.0.0.rc2",
    "8.0.1",
    "8.0.2",
    "8.0.2.1",
    "8.0.3",
    "8.0.4",
    "8.0.4.1",
    "8.0.5",
    "8.0.5.1"
  ]
}
low3.1
GHSA-gmj8-hvj3-49mwPackage fixes recorded

Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores

Action Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins) write the session cookie without a SameSite attribute, regardless of config.action_dispatch.cookies_same_site_protection, which defaults to :lax. Only CookieStore applies the configured policy. In browsers that do not treat a cookie without the attribute as SameSite=Lax, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verify an authenticity token, such as those of API-only applications.

Recorded fixes — actionpack: 8.1.4.1 or 8.0.5.2. Check your release branch.

Exploitation not established

RubyGems / actionpack
actionpack RubyGems
Affected range Recorded fix
From 8.1.0.beta1 before 8.1.4.1Ecosystem versions8.1.4.1

Version evidence: OSV · GHSA-gmj8-hvj3-49mw

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "8.1.0.beta1"
        },
        {
          "fixed": "8.1.4.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "8.1.0",
    "8.1.0.beta1",
    "8.1.0.rc1",
    "8.1.1",
    "8.1.2",
    "8.1.2.1",
    "8.1.3",
    "8.1.3.1",
    "8.1.4"
  ]
}
actionpack RubyGems
Affected range Recorded fix
Earlier releases before 8.0.5.2Ecosystem versions8.0.5.2

Version evidence: OSV · GHSA-gmj8-hvj3-49mw

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "8.0.5.2"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.9.0",
    "0.9.5",
    "1.0.0",
    "1.0.1",
    "1.1.0",
    "1.10.1",
    "1.10.2",
    "1.11.0",
    "1.11.1",
    "1.11.2",
    "1.12.0",
    "1.12.1",
    "1.12.2",
    "1.12.3",
    "1.12.4",
    "1.12.5",
    "1.13.0",
    "1.13.1",
    "1.13.2",
    "1.13.3",
    "1.13.4",
    "1.13.5",
    "1.13.6",
    "1.2.0",
    "1.3.0",
    "1.3.1",
    "1.4.0",
    "1.5.0",
    "1.5.1",
    "1.6.0",
    "1.7.0",
    "1.8.0",
    "1.8.1",
    "1.9.0",
    "1.9.1",
    "2.0.0",
    "2.0.1",
    "2.0.2",
    "2.0.4",
    "2.0.5",
    "2.1.0",
    "2.1.1",
    "2.1.2",
    "2.2.2",
    "2.2.3",
    "2.3.10",
    "2.3.11",
    "2.3.12",
    "2.3.14",
    "2.3.15",
    "2.3.16",
    "2.3.17",
    "2.3.18",
    "2.3.2",
    "2.3.3",
    "2.3.4",
    "2.3.5",
    "2.3.6",
    "2.3.7",
    "2.3.8",
    "2.3.8.pre1",
    "2.3.9",
    "2.3.9.pre",
    "3.0.0",
    "3.0.0.beta",
    "3.0.0.beta2",
    "3.0.0.beta3",
    "3.0.0.beta4",
    "3.0.0.rc",
    "3.0.0.rc2",
    "3.0.1",
    "3.0.10",
    "3.0.10.rc1",
    "3.0.11",
    "3.0.12",
    "3.0.12.rc1",
    "3.0.13",
    "3.0.13.rc1",
    "3.0.14",
    "3.0.15",
    "3.0.16",
    "3.0.17",
    "3.0.18",
    "3.0.19",
    "3.0.2",
    "3.0.20",
    "3.0.3",
    "3.0.4",
    "3.0.4.rc1",
    "3.0.5",
    "3.0.5.rc1",
    "3.0.6",
    "3.0.6.rc1",
    "3.0.6.rc2",
    "3.0.7",
    "3.0.7.rc1",
    "3.0.7.rc2",
    "3.0.8",
    "3.0.8.rc1",
    "3.0.8.rc2",
    "3.0.8.rc4",
    "3.0.9",
    "3.0.9.rc1",
    "3.0.9.rc3",
    "3.0.9.rc4",
    "3.0.9.rc5",
    "3.1.0",
    "3.1.0.beta1",
    "3.1.0.rc1",
    "3.1.0.rc2",
    "3.1.0.rc3",
    "3.1.0.rc4",
    "3.1.0.rc5",
    "3.1.0.rc6",
    "3.1.0.rc8",
    "3.1.1",
    "3.1.1.rc1",
    "3.1.1.rc2",
    "3.1.1.rc3",
    "3.1.10",
    "3.1.11",
    "3.1.12",
    "3.1.2",
    "3.1.2.rc1",
    "3.1.2.rc2",
    "3.1.3",
    "3.1.4",
    "3.1.4.rc1",
    "3.1.5",
    "3.1.5.rc1",
    "3.1.6",
    "3.1.7",
    "3.1.8",
    "3.1.9",
    "3.2.0",
    "3.2.0.rc1",
    "3.2.0.rc2",
    "3.2.1",
    "3.2.10",
    "3.2.11",
    "3.2.12",
    "3.2.13",
    "3.2.13.rc1",
    "3.2.13.rc2",
    "3.2.14",
    "3.2.14.rc1",
    "3.2.14.rc2",
    "3.2.15",
    "3.2.15.rc1",
    "3.2.15.rc2",
    "3.2.15.rc3",
    "3.2.16",
    "3.2.17",
    "3.2.18",
    "3.2.19",
    "3.2.2",
    "3.2.2.rc1",
    "3.2.20",
    "3.2.21",
    "3.2.22",
    "3.2.22.1",
    "3.2.22.2",
    "3.2.22.3",
    "3.2.22.4",
    "3.2.22.5",
    "3.2.3",
    "3.2.3.rc1",
    "3.2.3.rc2",
    "3.2.4",
    "3.2.4.rc1",
    "3.2.5",
    "3.2.6",
    "3.2.7",
    "3.2.7.rc1",
    "3.2.8",
    "3.2.8.rc1",
    "3.2.8.rc2",
    "3.2.9",
    "3.2.9.rc1",
    "3.2.9.rc2",
    "3.2.9.rc3",
    "4.0.0",
    "4.0.0.beta1",
    "4.0.0.rc1",
    "4.0.0.rc2",
    "4.0.1",
    "4.0.1.rc1",
    "4.0.1.rc2",
    "4.0.1.rc3",
    "4.0.1.rc4",
    "4.0.10",
    "4.0.10.rc1",
    "4.0.10.rc2",
    "4.0.11",
    "4.0.11.1",
    "4.0.12",
    "4.0.13",
    "4.0.13.rc1",
    "4.0.2",
    "4.0.3",
    "4.0.4",
    "4.0.4.rc1",
    "4.0.5",
    "4.0.6",
    "4.0.6.rc1",
    "4.0.6.rc2",
    "4.0.6.rc3",
    "4.0.7",
    "4.0.8",
    "4.0.9",
    "4.1.0",
    "4.1.0.beta1",
    "4.1.0.beta2",
    "4.1.0.rc1",
    "4.1.0.rc2",
    "4.1.1",
    "4.1.10",
    "4.1.10.rc1",
    "4.1.10.rc2",
    "4.1.10.rc3",
    "4.1.10.rc4",
    "4.1.11",
    "4.1.12",
    "4.1.12.rc1",
    "4.1.13",
    "4.1.13.rc1",
    "4.1.14",
    "4.1.14.1",
    "4.1.14.2",
    "4.1.14.rc1",
    "4.1.14.rc2",
    "4.1.15",
    "4.1.15.rc1",
    "4.1.16",
    "4.1.16.rc1",
    "4.1.2",
    "4.1.2.rc1",
    "4.1.2.rc2",
    "4.1.2.rc3",
    "4.1.3",
    "4.1.4",
    "4.1.5",
    "4.1.6",
    "4.1.6.rc1",
    "4.1.6.rc2",
    "4.1.7",
    "4.1.7.1",
    "4.1.8",
    "4.1.9",
    "4.1.9.rc1",
    "4.2.0",
    "4.2.0.beta1",
    "4.2.0.beta2",
    "4.2.0.beta3",
    "4.2.0.beta4",
    "4.2.0.rc1",
    "4.2.0.rc2",
    "4.2.0.rc3",
    "4.2.1",
    "4.2.1.rc1",
    "4.2.1.rc2",
    "4.2.1.rc3",
    "4.2.1.rc4",
    "4.2.10",
    "4.2.10.rc1",
    "4.2.11",
    "4.2.11.1",
    "4.2.11.2",
    "4.2.11.3",
    "4.2.2",
    "4.2.3",
    "4.2.3.rc1",
    "4.2.4",
    "4.2.4.rc1",
    "4.2.5",
    "4.2.5.1",
    "4.2.5.2",
    "4.2.5.rc1",
    "4.2.5.rc2",
    "4.2.6",
    "4.2.6.rc1",
    "4.2.7",
    "4.2.7.1",
    "4.2.7.rc1",
    "4.2.8",
    "4.2.8.rc1",
    "4.2.9",
    "4.2.9.rc1",
    "4.2.9.rc2",
    "5.0.0",
    "5.0.0.1",
    "5.0.0.beta1",
    "5.0.0.beta1.1",
    "5.0.0.beta2",
    "5.0.0.beta3",
    "5.0.0.beta4",
    "5.0.0.racecar1",
    "5.0.0.rc1",
    "5.0.0.rc2",
    "5.0.1",
    "5.0.1.rc1",
    "5.0.1.rc2",
    "5.0.2",
    "5.0.2.rc1",
    "5.0.3",
    "5.0.4",
    "5.0.4.rc1",
    "5.0.5",
    "5.0.5.rc1",
    "5.0.5.rc2",
    "5.0.6",
    "5.0.6.rc1",
    "5.0.7",
    "5.0.7.1",
    "5.0.7.2",
    "5.1.0",
    "5.1.0.beta1",
    "5.1.0.rc1",
    "5.1.0.rc2",
    "5.1.1",
    "5.1.2",
    "5.1.2.rc1",
    "5.1.3",
    "5.1.3.rc1",
    "5.1.3.rc2",
    "5.1.3.rc3",
    "5.1.4",
    "5.1.4.rc1",
    "5.1.5",
    "5.1.5.rc1",
    "5.1.6",
    "5.1.6.1",
    "5.1.6.2",
    "5.1.7",
    "5.1.7.rc1",
    "5.2.0",
    "5.2.0.beta1",
    "5.2.0.beta2",
    "5.2.0.rc1",
    "5.2.0.rc2",
    "5.2.1",
    "5.2.1.1",
    "5.2.1.rc1",
    "5.2.2",
    "5.2.2.1",
    "5.2.2.rc1",
    "5.2.3",
    "5.2.3.rc1",
    "5.2.4",
    "5.2.4.1",
    "5.2.4.2",
    "5.2.4.3",
    "5.2.4.4",
    "5.2.4.5",
    "5.2.4.6",
    "5.2.4.rc1",
    "5.2.5",
    "5.2.6",
    "5.2.6.1",
    "5.2.6.2",
    "5.2.6.3",
    "5.2.7",
    "5.2.7.1",
    "5.2.8",
    "5.2.8.1",
    "6.0.0",
    "6.0.0.beta1",
    "6.0.0.beta2",
    "6.0.0.beta3",
    "6.0.0.rc1",
    "6.0.0.rc2",
    "6.0.1",
    "6.0.1.rc1",
    "6.0.2",
    "6.0.2.1",
    "6.0.2.2",
    "6.0.2.rc1",
    "6.0.2.rc2",
    "6.0.3",
    "6.0.3.1",
    "6.0.3.2",
    "6.0.3.3",
    "6.0.3.4",
    "6.0.3.5",
    "6.0.3.6",
    "6.0.3.7",
    "6.0.3.rc1",
    "6.0.4",
    "6.0.4.1",
    "6.0.4.2",
    "6.0.4.3",
    "6.0.4.4",
    "6.0.4.5",
    "6.0.4.6",
    "6.0.4.7",
    "6.0.4.8",
    "6.0.5",
    "6.0.5.1",
    "6.0.6",
    "6.0.6.1",
    "6.1.0",
    "6.1.0.rc1",
    "6.1.0.rc2",
    "6.1.1",
    "6.1.2",
    "6.1.2.1",
    "6.1.3",
    "6.1.3.1",
    "6.1.3.2",
    "6.1.4",
    "6.1.4.1",
    "6.1.4.2",
    "6.1.4.3",
    "6.1.4.4",
    "6.1.4.5",
    "6.1.4.6",
    "6.1.4.7",
    "6.1.5",
    "6.1.5.1",
    "6.1.6",
    "6.1.6.1",
    "6.1.7",
    "6.1.7.1",
    "6.1.7.10",
    "6.1.7.2",
    "6.1.7.3",
    "6.1.7.4",
    "6.1.7.5",
    "6.1.7.6",
    "6.1.7.7",
    "6.1.7.8",
    "6.1.7.9",
    "7.0.0",
    "7.0.0.alpha1",
    "7.0.0.alpha2",
    "7.0.0.rc1",
    "7.0.0.rc2",
    "7.0.0.rc3",
    "7.0.1",
    "7.0.10",
    "7.0.2",
    "7.0.2.1",
    "7.0.2.2",
    "7.0.2.3",
    "7.0.2.4",
    "7.0.3",
    "7.0.3.1",
    "7.0.4",
    "7.0.4.1",
    "7.0.4.2",
    "7.0.4.3",
    "7.0.5",
    "7.0.5.1",
    "7.0.6",
    "7.0.7",
    "7.0.7.1",
    "7.0.7.2",
    "7.0.8",
    "7.0.8.1",
    "7.0.8.2",
    "7.0.8.3",
    "7.0.8.4",
    "7.0.8.5",
    "7.0.8.6",
    "7.0.8.7",
    "7.1.0",
    "7.1.0.beta1",
    "7.1.0.rc1",
    "7.1.0.rc2",
    "7.1.1",
    "7.1.2",
    "7.1.3",
    "7.1.3.1",
    "7.1.3.2",
    "7.1.3.3",
    "7.1.3.4",
    "7.1.4",
    "7.1.4.1",
    "7.1.4.2",
    "7.1.5",
    "7.1.5.1",
    "7.1.5.2",
    "7.1.6",
    "7.2.0",
    "7.2.0.beta1",
    "7.2.0.beta2",
    "7.2.0.beta3",
    "7.2.0.rc1",
    "7.2.1",
    "7.2.1.1",
    "7.2.1.2",
    "7.2.2",
    "7.2.2.1",
    "7.2.2.2",
    "7.2.3",
    "7.2.3.1",
    "7.2.3.2",
    "7.2.4",
    "8.0.0",
    "8.0.0.1",
    "8.0.0.beta1",
    "8.0.0.rc1",
    "8.0.0.rc2",
    "8.0.1",
    "8.0.2",
    "8.0.2.1",
    "8.0.3",
    "8.0.4",
    "8.0.4.1",
    "8.0.5",
    "8.0.5.1"
  ]
}