Log in Start free

Vulnerability · Published Feb 11, 2021 · Assigned by hackerone

CVE-2021-22880

High 7.5

In plain English

A high-severity uncontrolled resource consumption in https://github.com/rails/rails. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.5% (higher than 92% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)4.5%top 8.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rails2:6.0.3.5+dfsg-1DEBIAN-CVE-2021-22880
Debian:13rails2:6.0.3.5+dfsg-1DEBIAN-CVE-2021-22880
Debian:14rails2:6.0.3.5+dfsg-1DEBIAN-CVE-2021-22880
RubyGemsactiverecord5.2.4.5GHSA-8hc4-xxm3-5ppp
RubyGemsactiverecord6.0.3.5GHSA-8hc4-xxm3-5ppp
RubyGemsactiverecord6.1.2.1GHSA-8hc4-xxm3-5ppp
Ubuntu:24.04:LTSrailsno fix listedUBUNTU-CVE-2021-22880
Ubuntu:25.10railsno fix listedUBUNTU-CVE-2021-22880
Ubuntu:26.04:LTSrailsno fix listedUBUNTU-CVE-2021-22880
Ubuntu:26.10railsno fix listedUBUNTU-CVE-2021-22880

Affected products (as reported)

VendorProductVersions
n/a https://github.com/rails/rails Fixed in 6.1.2.1, 6.0.3.5, 5.2.4.5

Weakness: CWE-400

References