CVEvulnerability
CVE-2021-22902
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-06-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-400
Description
The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.
Affected configurations
• rubyonrails rails (>= 6.0.0 < 6.0.3.7)
• rubyonrails rails (>= 6.1.0 < 6.1.0.2)
Related
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://discuss.rubyonrails.org/t/cve-2021-22902-possible-denial-of-service-vulnerability-in-action-dispatch/77866 Exploit, Mitigation, Patch, Vendor Advisory
- https://hackerone.com/reports/1138654 Permissions Required, Third Party Advisory
- https://discuss.rubyonrails.org/t/cve-2021-22902-possible-denial-of-service-vulnerability-in-action-dispatch/77866 Exploit, Mitigation, Patch, Vendor Advisory
- https://hackerone.com/reports/1138654 Permissions Required, Third Party Advisory