Vulnerability · Published Jun 11, 2021 · Assigned by hackerone
CVE-2021-22902
High 7.5
In plain English
A high-severity uncontrolled resource consumption in https://github.com/rails/rails. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | rails | 2:6.0.3.7+dfsg-1 | DEBIAN-CVE-2021-22902 |
| Debian:13 | rails | 2:6.0.3.7+dfsg-1 | DEBIAN-CVE-2021-22902 |
| Debian:14 | rails | 2:6.0.3.7+dfsg-1 | DEBIAN-CVE-2021-22902 |
| RubyGems | actionpack | 6.0.3.7 | GHSA-g8ww-46x2-2p65 |
| RubyGems | actionpack | 6.1.3.2 | GHSA-g8ww-46x2-2p65 |
| Ubuntu:24.04:LTS | rails | no fix listed | UBUNTU-CVE-2021-22902 |
| Ubuntu:25.10 | rails | no fix listed | UBUNTU-CVE-2021-22902 |
| Ubuntu:26.04:LTS | rails | no fix listed | UBUNTU-CVE-2021-22902 |
| Ubuntu:26.10 | rails | no fix listed | UBUNTU-CVE-2021-22902 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | https://github.com/rails/rails | Fixed in 6.0.3.7, 6.1.3.2 |
Weakness: CWE-400