actionpack

Ruby on Rails

View on Rubygems

View on Github

Activity

Latest release: 1mo ago
Total releases: 518
Cadence: ~daily
Last 12 months: 16

Reach

Stars: 58.7k

Details

License: MIT
First release: Oct 25, 2004

Releases

Version	Released
`8.0.5.1` patch	Jul 29, 2026
`7.2.3.2` patch	Jul 29, 2026
`8.1.3.1` patch	Jul 29, 2026
`8.1.3` patch	Mar 24, 2026
`8.0.5` patch	Mar 24, 2026
`8.1.2.1` patch	Mar 23, 2026
`8.0.4.1` patch	Mar 23, 2026
`7.2.3.1` patch	Mar 23, 2026
`8.1.2` patch 1 CVE	Jan 08, 2026
`8.1.1` patch 1 CVE	Oct 28, 2025
`8.0.4` patch	Oct 28, 2025
`7.2.3` patch	Oct 28, 2025
`7.1.6` patch	Oct 28, 2025
`7.0.10` patch	Oct 28, 2025
`8.1.0` minor 1 CVE	Oct 22, 2025
`8.1.0.rc1` pre	Oct 15, 2025
`8.0.3` patch	Sep 22, 2025
`8.1.0.beta1` pre	Sep 04, 2025
`8.0.2.1` patch	Aug 13, 2025
`7.2.2.2` patch	Aug 13, 2025
`7.1.5.2` patch	Aug 13, 2025
`8.0.2` patch	Mar 12, 2025
`8.0.1` patch	Dec 13, 2024
`7.1.5.1` patch	Dec 10, 2024
`7.2.2.1` patch	Dec 10, 2024
`8.0.0.1` patch	Dec 10, 2024
`7.0.8.7` patch	Dec 10, 2024
`8.0.0` major 1 CVE	Nov 07, 2024
`7.1.5` patch 1 CVE	Oct 31, 2024
`7.2.2` patch 1 CVE	Oct 31, 2024
`8.0.0.rc2` pre	Oct 30, 2024
`7.0.8.6` patch 1 CVE	Oct 23, 2024
`7.1.4.2` patch 1 CVE	Oct 23, 2024
`6.1.7.10` patch 1 CVE	Oct 23, 2024
`7.2.1.2` patch 1 CVE	Oct 23, 2024
`8.0.0.rc1` pre	Oct 19, 2024
`7.2.1.1` patch 1 CVE	Oct 15, 2024
`6.1.7.9` patch 1 CVE	Oct 15, 2024
`7.1.4.1` patch 1 CVE	Oct 15, 2024
`7.0.8.5` patch 1 CVE	Oct 15, 2024
`8.0.0.beta1` pre	Sep 26, 2024
`7.1.4` patch 3 CVEs	Aug 22, 2024
`7.2.1` patch 3 CVEs	Aug 22, 2024
`7.2.0` minor 3 CVEs	Aug 09, 2024
`7.2.0.rc1` pre	Aug 06, 2024
`7.2.0.beta3` pre	Jul 11, 2024
`7.0.8.4` patch 3 CVEs	Jun 04, 2024
`7.2.0.beta2` pre	Jun 04, 2024
`7.1.3.4` patch 3 CVEs	Jun 04, 2024
`6.1.7.8` patch 3 CVEs	Jun 04, 2024

1–50 of 518

Repository

rails/rails

Forks: 22.3k
Open issues: 487
Language: Ruby
: 6.0/ 10

rails
mvc
html
activerecord
activejob
ruby

Dependencies (10)

Depends on

8.0.5.1

Used by

1872

Supply-chain exposure

1,872 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (62)

CVE-2026-33167 GHSA-pgm4-439c-5jp6 Mar 23, 2026

Rails has a possible XSS vulnerability in its Action Pack debug exceptions

Low
Network Low None

Impact

The debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (config.consider_all_requests_local = true), which is the default in development.

Releases

The fixed releases are available at the normal locations.

Credit

This issue was responsibly reported by Hackerone researcher fbettag.

Affected versions

8.1.08.1.18.1.2

Fixed in

8.1.2.1

References

https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6
https://nvd.nist.gov/vuln/detail/CVE-2026-33167
https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0
https://github.com/rails/rails
https://github.com/rails/rails/releases/tag/v8.1.2.1
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2026-33167.yml

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-54133 GHSA-vfm5-rmrh-j26v BIT-rails-2024-54133 Dec 10, 2024

Possible Content Security Policy bypass in Action Dispatch

Low
Network Low None

There is a possible Cross Site Scripting (XSS) vulnerability in the content_security_policy helper in Action Pack.

Impact

Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.

Releases

The fixed releases are available at the normal locations.

Workarounds

Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Credits

Thanks to ryotak for the report!

Affected versions

5.2.05.2.15.2.1.15.2.1.rc15.2.25.2.2.15.2.2.rc15.2.35.2.3.rc15.2.45.2.4.15.2.4.2

+ 130 more Show less

5.2.4.35.2.4.45.2.4.55.2.4.65.2.4.rc15.2.55.2.65.2.6.15.2.6.25.2.6.35.2.75.2.7.15.2.85.2.8.16.0.06.0.0.beta16.0.0.beta26.0.0.beta36.0.0.rc16.0.0.rc26.0.16.0.1.rc16.0.26.0.2.16.0.2.26.0.2.rc16.0.2.rc26.0.36.0.3.16.0.3.26.0.3.36.0.3.46.0.3.56.0.3.66.0.3.76.0.3.rc16.0.46.0.4.16.0.4.26.0.4.36.0.4.46.0.4.56.0.4.66.0.4.76.0.4.86.0.56.0.5.16.0.66.0.6.16.1.06.1.0.rc16.1.0.rc26.1.16.1.26.1.2.16.1.36.1.3.16.1.3.26.1.46.1.4.16.1.4.26.1.4.36.1.4.46.1.4.56.1.4.66.1.4.76.1.56.1.5.16.1.66.1.6.16.1.76.1.7.16.1.7.106.1.7.26.1.7.36.1.7.46.1.7.56.1.7.66.1.7.76.1.7.86.1.7.97.0.07.0.0.alpha17.0.0.alpha27.0.0.rc17.0.0.rc27.0.0.rc37.0.17.0.27.0.2.17.0.2.27.0.2.37.0.2.47.0.37.0.3.17.0.47.0.4.17.0.4.27.0.4.37.0.57.0.5.17.0.67.0.77.0.7.17.0.7.27.0.87.0.8.17.0.8.27.0.8.37.0.8.47.0.8.57.0.8.67.1.07.1.17.1.27.1.37.1.3.17.1.3.27.1.3.37.1.3.47.1.47.1.4.17.1.4.27.1.57.2.07.2.17.2.1.17.2.1.27.2.28.0.0

Fixed in

7.0.8.77.1.5.17.2.2.18.0.0.1

References

https://github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26v
https://nvd.nist.gov/vuln/detail/CVE-2024-54133
https://github.com/rails/rails/commit/2e3f41e4538b9ca1044357f6644f037bbb7c6c49
https://github.com/rails/rails/commit/3da2479cfe1e00177114b17e496213c40d286b3a
https://github.com/rails/rails/commit/5558e72f22fc69c1c407b31ac5fb3b4ce087b542
https://github.com/rails/rails/commit/cb16a3bb515b5d769f73926d9757270ace691f1d

Updated Mar 07, 2025 · Source: OSV.dev
CVE-2024-47887 GHSA-vfg9-r3fq-jvx4 BIT-rails-2024-47887 Oct 15, 2024

Possible ReDoS vulnerability in HTTP Token authentication in Action Controller

Medium
Network Low None None

There is a possible ReDoS vulnerability in Action Controller's HTTP Token authentication. This vulnerability has been assigned the CVE identifier CVE-2024-47887.

Impact

For applications using HTTP Token authentication via authenticate_or_request_with_http_token or similar, a carefully crafted header may cause header parsing to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately.

Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Releases

The fixed releases are available at the normal locations.

Workarounds

Users on Ruby 3.2 are unaffected by this issue.

Credits

Thanks to scyoon for reporting

Affected versions

4.0.04.0.14.0.1.rc14.0.1.rc24.0.1.rc34.0.1.rc44.0.104.0.10.rc14.0.10.rc24.0.114.0.11.14.0.12

+ 269 more Show less

4.0.134.0.13.rc14.0.24.0.34.0.44.0.4.rc14.0.54.0.64.0.6.rc14.0.6.rc24.0.6.rc34.0.74.0.84.0.94.1.04.1.0.beta14.1.0.beta24.1.0.rc14.1.0.rc24.1.14.1.104.1.10.rc14.1.10.rc24.1.10.rc34.1.10.rc44.1.114.1.124.1.12.rc14.1.134.1.13.rc14.1.144.1.14.14.1.14.24.1.14.rc14.1.14.rc24.1.154.1.15.rc14.1.164.1.16.rc14.1.24.1.2.rc14.1.2.rc24.1.2.rc34.1.34.1.44.1.54.1.64.1.6.rc14.1.6.rc24.1.74.1.7.14.1.84.1.94.1.9.rc14.2.04.2.0.beta14.2.0.beta24.2.0.beta34.2.0.beta44.2.0.rc14.2.0.rc24.2.0.rc34.2.14.2.1.rc14.2.1.rc24.2.1.rc34.2.1.rc44.2.104.2.10.rc14.2.114.2.11.14.2.11.24.2.11.34.2.24.2.34.2.3.rc14.2.44.2.4.rc14.2.54.2.5.14.2.5.24.2.5.rc14.2.5.rc24.2.64.2.6.rc14.2.74.2.7.14.2.7.rc14.2.84.2.8.rc14.2.94.2.9.rc14.2.9.rc25.0.05.0.0.15.0.0.beta15.0.0.beta1.15.0.0.beta25.0.0.beta35.0.0.beta45.0.0.racecar15.0.0.rc15.0.0.rc25.0.15.0.1.rc15.0.1.rc25.0.25.0.2.rc15.0.35.0.45.0.4.rc15.0.55.0.5.rc15.0.5.rc25.0.65.0.6.rc15.0.75.0.7.15.0.7.25.1.05.1.0.beta15.1.0.rc15.1.0.rc25.1.15.1.25.1.2.rc15.1.35.1.3.rc15.1.3.rc25.1.3.rc35.1.45.1.4.rc15.1.55.1.5.rc15.1.65.1.6.15.1.6.25.1.75.1.7.rc15.2.05.2.0.beta15.2.0.beta25.2.0.rc15.2.0.rc25.2.15.2.1.15.2.1.rc15.2.25.2.2.15.2.2.rc15.2.35.2.3.rc15.2.45.2.4.15.2.4.25.2.4.35.2.4.45.2.4.55.2.4.65.2.4.rc15.2.55.2.65.2.6.15.2.6.25.2.6.35.2.75.2.7.15.2.85.2.8.16.0.06.0.0.beta16.0.0.beta26.0.0.beta36.0.0.rc16.0.0.rc26.0.16.0.1.rc16.0.26.0.2.16.0.2.26.0.2.rc16.0.2.rc26.0.36.0.3.16.0.3.26.0.3.36.0.3.46.0.3.56.0.3.66.0.3.76.0.3.rc16.0.46.0.4.16.0.4.26.0.4.36.0.4.46.0.4.56.0.4.66.0.4.76.0.4.86.0.56.0.5.16.0.66.0.6.16.1.06.1.0.rc16.1.0.rc26.1.16.1.26.1.2.16.1.36.1.3.16.1.3.26.1.46.1.4.16.1.4.26.1.4.36.1.4.46.1.4.56.1.4.66.1.4.76.1.56.1.5.16.1.66.1.6.16.1.76.1.7.16.1.7.26.1.7.36.1.7.46.1.7.56.1.7.66.1.7.76.1.7.87.0.07.0.17.0.27.0.2.17.0.2.27.0.2.37.0.2.47.0.37.0.3.17.0.47.0.4.17.0.4.27.0.4.37.0.57.0.5.17.0.67.0.77.0.7.17.0.7.27.0.87.0.8.17.0.8.27.0.8.37.0.8.47.1.07.1.17.1.27.1.37.1.3.17.1.3.27.1.3.37.1.3.47.1.47.2.07.2.1

Fixed in

6.1.7.97.0.8.57.1.4.17.2.1.1

References

https://github.com/rails/rails/security/advisories/GHSA-vfg9-r3fq-jvx4
https://github.com/rails/rails
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-47887.yml

Updated Oct 31, 2024 · Source: OSV.dev
CVE-2024-41128 GHSA-x76w-6vjr-8xgj BIT-rails-2024-41128 Oct 15, 2024

Possible ReDoS vulnerability in query parameter filtering in Action Dispatch

Medium
Network Low None None

There is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2024-41128.

Impact

Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately.

Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Releases

The fixed releases are available at the normal locations.

Workarounds

Users on Ruby 3.2 are unaffected by this issue.

Credits

Thanks to scyoon for the report and patches!

Affected versions

3.1.03.1.13.1.1.rc13.1.1.rc23.1.1.rc33.1.103.1.113.1.123.1.23.1.2.rc13.1.2.rc23.1.3

+ 339 more Show less

3.1.43.1.4.rc13.1.53.1.5.rc13.1.63.1.73.1.83.1.93.2.03.2.0.rc13.2.0.rc23.2.13.2.103.2.113.2.123.2.133.2.13.rc13.2.13.rc23.2.143.2.14.rc13.2.14.rc23.2.153.2.15.rc13.2.15.rc23.2.15.rc33.2.163.2.173.2.183.2.193.2.23.2.2.rc13.2.203.2.213.2.223.2.22.13.2.22.23.2.22.33.2.22.43.2.22.53.2.33.2.3.rc13.2.3.rc23.2.43.2.4.rc13.2.53.2.63.2.73.2.7.rc13.2.83.2.8.rc13.2.8.rc23.2.93.2.9.rc13.2.9.rc23.2.9.rc34.0.04.0.0.beta14.0.0.rc14.0.0.rc24.0.14.0.1.rc14.0.1.rc24.0.1.rc34.0.1.rc44.0.104.0.10.rc14.0.10.rc24.0.114.0.11.14.0.124.0.134.0.13.rc14.0.24.0.34.0.44.0.4.rc14.0.54.0.64.0.6.rc14.0.6.rc24.0.6.rc34.0.74.0.84.0.94.1.04.1.0.beta14.1.0.beta24.1.0.rc14.1.0.rc24.1.14.1.104.1.10.rc14.1.10.rc24.1.10.rc34.1.10.rc44.1.114.1.124.1.12.rc14.1.134.1.13.rc14.1.144.1.14.14.1.14.24.1.14.rc14.1.14.rc24.1.154.1.15.rc14.1.164.1.16.rc14.1.24.1.2.rc14.1.2.rc24.1.2.rc34.1.34.1.44.1.54.1.64.1.6.rc14.1.6.rc24.1.74.1.7.14.1.84.1.94.1.9.rc14.2.04.2.0.beta14.2.0.beta24.2.0.beta34.2.0.beta44.2.0.rc14.2.0.rc24.2.0.rc34.2.14.2.1.rc14.2.1.rc24.2.1.rc34.2.1.rc44.2.104.2.10.rc14.2.114.2.11.14.2.11.24.2.11.34.2.24.2.34.2.3.rc14.2.44.2.4.rc14.2.54.2.5.14.2.5.24.2.5.rc14.2.5.rc24.2.64.2.6.rc14.2.74.2.7.14.2.7.rc14.2.84.2.8.rc14.2.94.2.9.rc14.2.9.rc25.0.05.0.0.15.0.0.beta15.0.0.beta1.15.0.0.beta25.0.0.beta35.0.0.beta45.0.0.racecar15.0.0.rc15.0.0.rc25.0.15.0.1.rc15.0.1.rc25.0.25.0.2.rc15.0.35.0.45.0.4.rc15.0.55.0.5.rc15.0.5.rc25.0.65.0.6.rc15.0.75.0.7.15.0.7.25.1.05.1.0.beta15.1.0.rc15.1.0.rc25.1.15.1.25.1.2.rc15.1.35.1.3.rc15.1.3.rc25.1.3.rc35.1.45.1.4.rc15.1.55.1.5.rc15.1.65.1.6.15.1.6.25.1.75.1.7.rc15.2.05.2.0.beta15.2.0.beta25.2.0.rc15.2.0.rc25.2.15.2.1.15.2.1.rc15.2.25.2.2.15.2.2.rc15.2.35.2.3.rc15.2.45.2.4.15.2.4.25.2.4.35.2.4.45.2.4.55.2.4.65.2.4.rc15.2.55.2.65.2.6.15.2.6.25.2.6.35.2.75.2.7.15.2.85.2.8.16.0.06.0.0.beta16.0.0.beta26.0.0.beta36.0.0.rc16.0.0.rc26.0.16.0.1.rc16.0.26.0.2.16.0.2.26.0.2.rc16.0.2.rc26.0.36.0.3.16.0.3.26.0.3.36.0.3.46.0.3.56.0.3.66.0.3.76.0.3.rc16.0.46.0.4.16.0.4.26.0.4.36.0.4.46.0.4.56.0.4.66.0.4.76.0.4.86.0.56.0.5.16.0.66.0.6.16.1.06.1.0.rc16.1.0.rc26.1.16.1.26.1.2.16.1.36.1.3.16.1.3.26.1.46.1.4.16.1.4.26.1.4.36.1.4.46.1.4.56.1.4.66.1.4.76.1.56.1.5.16.1.66.1.6.16.1.76.1.7.16.1.7.26.1.7.36.1.7.46.1.7.56.1.7.66.1.7.76.1.7.87.0.07.0.17.0.27.0.2.17.0.2.27.0.2.37.0.2.47.0.37.0.3.17.0.47.0.4.17.0.4.27.0.4.37.0.57.0.5.17.0.67.0.77.0.7.17.0.7.27.0.87.0.8.17.0.8.27.0.8.37.0.8.47.1.07.1.17.1.27.1.37.1.3.17.1.3.27.1.3.37.1.3.47.1.47.2.07.2.1

Fixed in

6.1.7.97.0.8.57.1.4.17.2.1.1

References

https://github.com/rails/rails/security/advisories/GHSA-x76w-6vjr-8xgj
https://nvd.nist.gov/vuln/detail/CVE-2024-41128
https://github.com/rails/rails/commit/27121e80f6dbb260f5a9f0452cd8411cb681f075
https://github.com/rails/rails/commit/b0fe99fa854ec8ff4498e75779b458392d1560ef
https://github.com/rails/rails/commit/b1241f468d1b32235f438c2e2203386e6efd3891
https://github.com/rails/rails/commit/fb493bebae1a9b83e494fe7edbf01f6167d606fd

Updated Oct 31, 2024 · Source: OSV.dev
CVE-2024-28103 GHSA-fwhr-88qx-h9g7 BIT-rails-2024-28103 Jun 04, 2024

Missing security headers in Action Pack on non-HTML responses

5.4 / 10
Medium
Network Low None Required Unchanged Low Low None

Permissions-Policy is Only Served on HTML Content-Type

The application configurable Permissions-Policy is only served on responses with an HTML related Content-Type.

This has been assigned the CVE identifier CVE-2024-28103.

Versions Affected: >= 6.1.0 Not affected: < 6.1.0 Fixed Versions: 6.1.7.8, 7.0.8.4, and 7.1.3.4

Impact

Responses with a non-HTML Content-Type are not serving the configured Permissions-Policy. There are certain non-HTML Content-Types that would benefit from having the Permissions-Policy enforced.

Releases

The fixed releases are available at the normal locations.

Workarounds

N/A

Patches

To aid users who aren't able to upgrade immediately we have provided patches for the supported release series in accordance with our maintenance policy regarding security issues. They are in git-am format and consist of a single changeset.

6-1-include-permissions-policy-header-on-non-html.patch - Patch for 6.1 series

7-0-include-permissions-policy-header-on-non-html.patch - Patch for 7.0 series

7-1-include-permissions-policy-header-on-non-html.patch - Patch for 7.1 series

Credits

Thank you shinkbr for reporting this!

Affected versions

6.1.06.1.16.1.26.1.2.16.1.36.1.3.16.1.3.26.1.46.1.4.16.1.4.26.1.4.36.1.4.4

+ 46 more Show less

6.1.4.56.1.4.66.1.4.76.1.56.1.5.16.1.66.1.6.16.1.76.1.7.16.1.7.26.1.7.36.1.7.46.1.7.56.1.7.66.1.7.77.0.07.0.17.0.27.0.2.17.0.2.27.0.2.37.0.2.47.0.37.0.3.17.0.47.0.4.17.0.4.27.0.4.37.0.57.0.5.17.0.67.0.77.0.7.17.0.7.27.0.87.0.8.17.0.8.27.0.8.37.1.07.1.17.1.27.1.37.1.3.17.1.3.27.1.3.37.2.0.beta1

Fixed in

6.1.7.87.0.8.47.1.3.47.2.0.beta2

References

https://github.com/rails/rails/security/advisories/GHSA-fwhr-88qx-h9g7
https://nvd.nist.gov/vuln/detail/CVE-2024-28103
https://github.com/rails/rails/commit/35858f1d9d57f6c4050a8d9ab754bd5d088b4523
https://github.com/rails/rails
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-28103.yml
https://security.netapp.com/advisory/ntap-20241206-0002

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2024-26143 GHSA-9822-6m93-xqf4 BIT-rails-2024-26143 Feb 27, 2024

Rails has possible XSS Vulnerability in Action Controller

6.1 / 10
Medium
Network Low None Required Changed Low Low None

Possible XSS Vulnerability in Action Controller

There is a possible XSS vulnerability when using the translation helpers (translate, t, etc) in Action Controller. This vulnerability has been assigned the CVE identifier CVE-2024-26143.

Versions Affected: >= 7.0.0. Not affected: < 7.0.0 Fixed Versions: 7.1.3.1, 7.0.8.1

Impact

Applications using translation methods like translate, or t on a controller, with a key ending in "_html", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability.

For example, impacted code will look something like this:

class ArticlesController < ApplicationController def show @message = t("message_html", default: untrusted_input) # The `show` template displays the contents of `@message` end end

To reiterate the pre-conditions, applications must:

Use a translation function from a controller (i.e. not I18n.t, or t from a view)

Use a key that ends in _html

Use a default value where the default value is untrusted and unescaped input

Send the text to the victim (whether that's part of a template, or a render call)

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The fixed releases are available at the normal locations.

Workarounds

There are no feasible workarounds for this issue.

Patches

To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

7-0-translate-xss.patch - Patch for 7.0 series

7-1-translate-xss.patch - Patch for 7.1 series

Credits

Thanks to ooooooo_q for the patch and fix!

Affected versions

7.0.07.0.17.0.27.0.2.17.0.2.27.0.2.37.0.2.47.0.37.0.3.17.0.47.0.4.17.0.4.2

+ 12 more Show less

7.0.4.37.0.57.0.5.17.0.67.0.77.0.7.17.0.7.27.0.87.1.07.1.17.1.27.1.3

Fixed in

7.0.8.17.1.3.1

References

https://github.com/rails/rails/security/advisories/GHSA-9822-6m93-xqf4
https://nvd.nist.gov/vuln/detail/CVE-2024-26143
https://github.com/rails/rails/commit/4c83b331092a79d58e4adffe4be5f250fa5782cc
https://github.com/rails/rails/commit/5187a9ef51980ad1b8e81945ebe0462d28f84f9e
https://discuss.rubyonrails.org/t/possible-xss-vulnerability-in-action-controller/84947
https://github.com/rails/rails

Updated Jun 08, 2026 · Source: OSV.dev
CVE-2024-26142 GHSA-jjhx-jhvp-74wq BIT-rails-2024-26142 Feb 27, 2024

Rails has possible ReDoS vulnerability in Accept header parsing in Action Dispatch

Low

Possible ReDoS vulnerability in Accept header parsing in Action Dispatch

There is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2024-26142.

Versions Affected: >= 7.1.0, < 7.1.3.1 Not affected: < 7.1.0 Fixed Versions: 7.1.3.1

Impact

Carefully crafted Accept headers can cause Accept header parsing in Action Dispatch to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or use one of the workarounds immediately.

Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected.

Releases

The fixed releases are available at the normal locations.

Workarounds

There are no feasible workarounds for this issue.

Patches

To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

7-1-accept-redox.patch - Patch for 7.1 series

Credits

Thanks svalkanov for the report and patch!

Affected versions

7.1.07.1.17.1.27.1.3

Fixed in

7.1.3.1

References

https://github.com/rails/rails/security/advisories/GHSA-jjhx-jhvp-74wq
https://nvd.nist.gov/vuln/detail/CVE-2024-26142
https://github.com/rails/rails/commit/b4d3bfb5ed8a5b5a90aad3a3b28860c7a931e272
https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946
https://github.com/rails/rails
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26142.yml

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2023-28362 GHSA-4g8v-vg43-wpgf Jun 29, 2023

Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to

4.0 / 10
Medium
Local Low None None Unchanged None Low None

The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header. This vulnerability has been assigned the CVE identifier CVE-2023-28362.

Versions Affected: All. Not affected: None Fixed Versions: 7.0.5.1, 6.1.7.4

Impact

This introduces the potential for a Cross-site-scripting (XSS) payload to be delivered on the now static redirection page. Note that this both requires user interaction and for a Rails app to be configured to allow redirects to external hosts (defaults to false in Rails >= 7.0.x).

Releases

The FIXED releases are available at the normal locations.

Workarounds

Avoid providing user supplied URLs with arbitrary schemes to the redirect_to method.

Affected versions

0.9.00.9.51.0.01.0.11.1.01.10.11.10.21.11.01.11.11.11.21.12.01.12.1

+ 427 more Show less

1.12.21.12.31.12.41.12.51.13.01.13.11.13.21.13.31.13.41.13.51.13.61.2.01.3.01.3.11.4.01.5.01.5.11.6.01.7.01.8.01.8.11.9.01.9.12.0.02.0.12.0.22.0.42.0.52.1.02.1.12.1.22.2.22.2.32.3.102.3.112.3.122.3.142.3.152.3.162.3.172.3.182.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.8.pre12.3.92.3.9.pre3.0.03.0.0.beta3.0.0.beta23.0.0.beta33.0.0.beta43.0.0.rc3.0.0.rc23.0.13.0.103.0.10.rc13.0.113.0.123.0.12.rc13.0.133.0.13.rc13.0.143.0.153.0.163.0.173.0.183.0.193.0.23.0.203.0.33.0.43.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc53.1.03.1.0.beta13.1.0.rc13.1.0.rc23.1.0.rc33.1.0.rc43.1.0.rc53.1.0.rc63.1.0.rc83.1.13.1.1.rc13.1.1.rc23.1.1.rc33.1.103.1.113.1.123.1.23.1.2.rc13.1.2.rc23.1.33.1.43.1.4.rc13.1.53.1.5.rc13.1.63.1.73.1.83.1.93.2.03.2.0.rc13.2.0.rc23.2.13.2.103.2.113.2.123.2.133.2.13.rc13.2.13.rc23.2.143.2.14.rc13.2.14.rc23.2.153.2.15.rc13.2.15.rc23.2.15.rc33.2.163.2.173.2.183.2.193.2.23.2.2.rc13.2.203.2.213.2.223.2.22.13.2.22.23.2.22.33.2.22.43.2.22.53.2.33.2.3.rc13.2.3.rc23.2.43.2.4.rc13.2.53.2.63.2.73.2.7.rc13.2.83.2.8.rc13.2.8.rc23.2.93.2.9.rc13.2.9.rc23.2.9.rc34.0.04.0.0.beta14.0.0.rc14.0.0.rc24.0.14.0.1.rc14.0.1.rc24.0.1.rc34.0.1.rc44.0.104.0.10.rc14.0.10.rc24.0.114.0.11.14.0.124.0.134.0.13.rc14.0.24.0.34.0.44.0.4.rc14.0.54.0.64.0.6.rc14.0.6.rc24.0.6.rc34.0.74.0.84.0.94.1.04.1.0.beta14.1.0.beta24.1.0.rc14.1.0.rc24.1.14.1.104.1.10.rc14.1.10.rc24.1.10.rc34.1.10.rc44.1.114.1.124.1.12.rc14.1.134.1.13.rc14.1.144.1.14.14.1.14.24.1.14.rc14.1.14.rc24.1.154.1.15.rc14.1.164.1.16.rc14.1.24.1.2.rc14.1.2.rc24.1.2.rc34.1.34.1.44.1.54.1.64.1.6.rc14.1.6.rc24.1.74.1.7.14.1.84.1.94.1.9.rc14.2.04.2.0.beta14.2.0.beta24.2.0.beta34.2.0.beta44.2.0.rc14.2.0.rc24.2.0.rc34.2.14.2.1.rc14.2.1.rc24.2.1.rc34.2.1.rc44.2.104.2.10.rc14.2.114.2.11.14.2.11.24.2.11.34.2.24.2.34.2.3.rc14.2.44.2.4.rc14.2.54.2.5.14.2.5.24.2.5.rc14.2.5.rc24.2.64.2.6.rc14.2.74.2.7.14.2.7.rc14.2.84.2.8.rc14.2.94.2.9.rc14.2.9.rc25.0.05.0.0.15.0.0.beta15.0.0.beta1.15.0.0.beta25.0.0.beta35.0.0.beta45.0.0.racecar15.0.0.rc15.0.0.rc25.0.15.0.1.rc15.0.1.rc25.0.25.0.2.rc15.0.35.0.45.0.4.rc15.0.55.0.5.rc15.0.5.rc25.0.65.0.6.rc15.0.75.0.7.15.0.7.25.1.05.1.0.beta15.1.0.rc15.1.0.rc25.1.15.1.25.1.2.rc15.1.35.1.3.rc15.1.3.rc25.1.3.rc35.1.45.1.4.rc15.1.55.1.5.rc15.1.65.1.6.15.1.6.25.1.75.1.7.rc15.2.05.2.0.beta15.2.0.beta25.2.0.rc15.2.0.rc25.2.15.2.1.15.2.1.rc15.2.25.2.2.15.2.2.rc15.2.35.2.3.rc15.2.45.2.4.15.2.4.25.2.4.35.2.4.45.2.4.55.2.4.65.2.4.rc15.2.55.2.65.2.6.15.2.6.25.2.6.35.2.75.2.7.15.2.85.2.8.16.0.06.0.0.beta16.0.0.beta26.0.0.beta36.0.0.rc16.0.0.rc26.0.16.0.1.rc16.0.26.0.2.16.0.2.26.0.2.rc16.0.2.rc26.0.36.0.3.16.0.3.26.0.3.36.0.3.46.0.3.56.0.3.66.0.3.76.0.3.rc16.0.46.0.4.16.0.4.26.0.4.36.0.4.46.0.4.56.0.4.66.0.4.76.0.4.86.0.56.0.5.16.0.66.0.6.16.1.06.1.0.rc16.1.0.rc26.1.16.1.26.1.2.16.1.36.1.3.16.1.3.26.1.46.1.4.16.1.4.26.1.4.36.1.4.46.1.4.56.1.4.66.1.4.76.1.56.1.5.16.1.66.1.6.16.1.76.1.7.16.1.7.26.1.7.37.0.07.0.17.0.27.0.2.17.0.2.27.0.2.37.0.2.47.0.37.0.3.17.0.47.0.4.17.0.4.27.0.4.37.0.5

Fixed in

6.1.7.47.0.5.1

References

https://nvd.nist.gov/vuln/detail/CVE-2023-28362
https://github.com/rails/rails/commit/1c3f93d1e90a3475f9ae2377ead25ccf11f71441
https://github.com/rails/rails/commit/69e37c84e3f77d75566424c7d0015172d6a6fac5
https://github.com/rails/rails/commit/c9ab9b32bcdcfd8bcd55907f6c7b20b4e004cc23
https://discuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132
https://github.com/rails/rails

Updated May 05, 2025 · Source: OSV.dev
CVE-2023-22792 GHSA-p84v-45xj-wwqj Jan 18, 2023

ReDoS based DoS vulnerability in Action Dispatch

Low

There is a possible regular expression based DoS vulnerability in Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2023-22792.

Versions Affected: >= 3.0.0 Not affected: < 3.0.0 Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1 Impact

Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately. Releases

The FIXED releases are available at the normal locations. Workarounds

We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can mitigate this vulnerability by using a load balancer or other device to filter out malicious X_FORWARDED_HOST headers before they reach the application. Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

6-1-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 6.1 series 7-0-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released

Affected versions

3.0.03.0.13.0.103.0.10.rc13.0.113.0.123.0.12.rc13.0.133.0.13.rc13.0.143.0.153.0.16

+ 346 more Show less

3.0.173.0.183.0.193.0.23.0.203.0.33.0.43.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc53.1.03.1.0.beta13.1.0.rc13.1.0.rc23.1.0.rc33.1.0.rc43.1.0.rc53.1.0.rc63.1.0.rc83.1.13.1.1.rc13.1.1.rc23.1.1.rc33.1.103.1.113.1.123.1.23.1.2.rc13.1.2.rc23.1.33.1.43.1.4.rc13.1.53.1.5.rc13.1.63.1.73.1.83.1.93.2.03.2.0.rc13.2.0.rc23.2.13.2.103.2.113.2.123.2.133.2.13.rc13.2.13.rc23.2.143.2.14.rc13.2.14.rc23.2.153.2.15.rc13.2.15.rc23.2.15.rc33.2.163.2.173.2.183.2.193.2.23.2.2.rc13.2.203.2.213.2.223.2.22.13.2.22.23.2.22.33.2.22.43.2.22.53.2.33.2.3.rc13.2.3.rc23.2.43.2.4.rc13.2.53.2.63.2.73.2.7.rc13.2.83.2.8.rc13.2.8.rc23.2.93.2.9.rc13.2.9.rc23.2.9.rc34.0.04.0.0.beta14.0.0.rc14.0.0.rc24.0.14.0.1.rc14.0.1.rc24.0.1.rc34.0.1.rc44.0.104.0.10.rc14.0.10.rc24.0.114.0.11.14.0.124.0.134.0.13.rc14.0.24.0.34.0.44.0.4.rc14.0.54.0.64.0.6.rc14.0.6.rc24.0.6.rc34.0.74.0.84.0.94.1.04.1.0.beta14.1.0.beta24.1.0.rc14.1.0.rc24.1.14.1.104.1.10.rc14.1.10.rc24.1.10.rc34.1.10.rc44.1.114.1.124.1.12.rc14.1.134.1.13.rc14.1.144.1.14.14.1.14.24.1.14.rc14.1.14.rc24.1.154.1.15.rc14.1.164.1.16.rc14.1.24.1.2.rc14.1.2.rc24.1.2.rc34.1.34.1.44.1.54.1.64.1.6.rc14.1.6.rc24.1.74.1.7.14.1.84.1.94.1.9.rc14.2.04.2.0.beta14.2.0.beta24.2.0.beta34.2.0.beta44.2.0.rc14.2.0.rc24.2.0.rc34.2.14.2.1.rc14.2.1.rc24.2.1.rc34.2.1.rc44.2.104.2.10.rc14.2.114.2.11.14.2.11.24.2.11.34.2.24.2.34.2.3.rc14.2.44.2.4.rc14.2.54.2.5.14.2.5.24.2.5.rc14.2.5.rc24.2.64.2.6.rc14.2.74.2.7.14.2.7.rc14.2.84.2.8.rc14.2.94.2.9.rc14.2.9.rc25.0.05.0.0.15.0.0.beta15.0.0.beta1.15.0.0.beta25.0.0.beta35.0.0.beta45.0.0.racecar15.0.0.rc15.0.0.rc25.0.15.0.1.rc15.0.1.rc25.0.25.0.2.rc15.0.35.0.45.0.4.rc15.0.55.0.5.rc15.0.5.rc25.0.65.0.6.rc15.0.75.0.7.15.0.7.25.1.05.1.0.beta15.1.0.rc15.1.0.rc25.1.15.1.25.1.2.rc15.1.35.1.3.rc15.1.3.rc25.1.3.rc35.1.45.1.4.rc15.1.55.1.5.rc15.1.65.1.6.15.1.6.25.1.75.1.7.rc15.2.05.2.0.beta15.2.0.beta25.2.0.rc15.2.0.rc25.2.15.2.1.15.2.1.rc15.2.25.2.2.15.2.2.rc15.2.35.2.3.rc15.2.45.2.4.15.2.4.25.2.4.35.2.4.45.2.4.55.2.4.65.2.4.rc15.2.55.2.65.2.6.15.2.6.25.2.6.35.2.75.2.7.15.2.85.2.8.16.0.06.0.16.0.1.rc16.0.26.0.2.16.0.2.26.0.2.rc16.0.2.rc26.0.36.0.3.16.0.3.26.0.3.36.0.3.46.0.3.56.0.3.66.0.3.76.0.3.rc16.0.46.0.4.16.0.4.26.0.4.36.0.4.46.0.4.56.0.4.66.0.4.76.0.4.86.0.56.0.5.16.0.66.0.6.16.1.06.1.0.rc16.1.0.rc26.1.16.1.26.1.2.16.1.36.1.3.16.1.3.26.1.46.1.4.16.1.4.26.1.4.36.1.4.46.1.4.56.1.4.66.1.4.76.1.56.1.5.16.1.66.1.6.16.1.77.0.07.0.17.0.27.0.2.17.0.2.27.0.2.37.0.2.47.0.37.0.3.17.0.4

Fixed in

5.2.8.156.1.7.17.0.4.1

References

https://nvd.nist.gov/vuln/detail/CVE-2023-22792
https://discuss.rubyonrails.org/t/cve-2023-22792-possible-redos-based-dos-vulnerability-in-action-dispatch/82115
https://github.com/rails/rails
https://github.com/rails/rails/releases/tag/v7.0.4.1
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-22792.yml
https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released

Updated Feb 18, 2025 · Source: OSV.dev
CVE-2023-22797 GHSA-9445-4cr6-336r Jan 18, 2023

Open Redirect Vulnerability in Action Pack

6.1 / 10
Medium
Network Low None Required Changed Low Low None

There is a vulnerability in Action Controller’s redirect_to. This vulnerability has been assigned the CVE identifier CVE-2023-22797.

Versions Affected: >= 7.0.0 Not affected: < 7.0.0 Fixed Versions: 7.0.4.1 Impact

There is a possible open redirect when using the redirect_to helper with untrusted user input.

Vulnerable code will look like this:

redirect_to(params[:some_param])

Rails 7.0 introduced protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the check introduced could be bypassed by a carefully crafted URL.

All users running an affected release should either upgrade or use one of the workarounds immediately. Releases

The FIXED releases are available at the normal locations. Workarounds

There are no feasible workarounds for this issue. Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

7-0-Fix-sec-issue-with-_url_host_allowed.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Affected versions

7.0.07.0.17.0.27.0.2.17.0.2.27.0.2.37.0.2.47.0.37.0.3.17.0.4

Fixed in

7.0.4.1

References

https://nvd.nist.gov/vuln/detail/CVE-2023-22797
https://discuss.rubyonrails.org/t/cve-2023-22799-possible-redos-based-dos-vulnerability-in-globalid/82127
https://github.com/rails/rails
https://github.com/rails/rails/releases/tag/v7.0.4.1
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-22797.yml

Updated Feb 16, 2024 · Source: OSV.dev

1–10 of 62

Insights

Releases per month

last 12 months

Release mix

major 8
minor 26
patch 309
pre 174

518 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More