actionpack
RubyGems62 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting actionpackpage 2 of 2
- CVE-2022-23633HIGHCVSS 7.4EG 7.4fixed in 5.2.6.2, 6.0.4.6, 6.1.4.6 or 7.0.2.2, by version range2022-02-11
vulnerable: 7.0.0, 7.0.1, 7.0.2, 7.0.2.1
Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to res…
- CVE-2023-22792HIGHCVSS 7.5EG 7.5fixed in 5.2.8.15, 6.1.7.1 or 7.0.4.1, by version range2023-02-09
vulnerable: 7.0.0 ... 7.0.4 (10 versions)
A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a…
- CVE-2023-22795HIGHCVSS 7.5EG 7.5fixed in 6.1.7.1 or 7.0.4.1, by version range2023-02-09
vulnerable: 7.0.0 ... 7.0.4 (10 versions)
A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastroph…
- CVE-2023-22797MEDIUMCVSS 6.1EG 6.1fixed in 7.0.4.12023-02-09
vulnerable: 7.0.0 ... 7.0.4 (10 versions)
An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted in…
- CVE-2023-28362MEDIUMCVSS 4.0EG 4.0fixed in 6.1.7.4 or 7.0.5.1, by version range2025-01-09
vulnerable: 7.0.0 ... 7.0.5 (14 versions)
The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove…
- CVE-2024-26142HIGHCVSS 7.5EG 7.5fixed in 7.1.3.12024-02-27
vulnerable: 7.1.0, 7.1.1, 7.1.2, 7.1.3
Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routines of Action Dispatch. This vulnerability is patched in 7.1.3.1. Ruby 3.2 has mitigations for this …
- CVE-2024-26143MEDIUMCVSS 6.1EG 6.1fixed in 7.0.8.1 or 7.1.3.1, by version range2024-02-27
vulnerable: 7.1.0, 7.1.1, 7.1.2, 7.1.3
Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in "_html",…
- CVE-2024-28103MEDIUMCVSS 5.4EG 5.4fixed in 6.1.7.8, 7.0.8.4, 7.1.3.4 or 7.2.0.beta2, by version range2024-06-04
vulnerable: 7.2.0.beta1
Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.…
- CVE-2024-41128MEDIUMCVSS 6.6EG 6.6fixed in 6.1.7.9, 7.0.8.5, 7.1.4.1 or 7.2.1.1, by version range2024-10-16
vulnerable: 7.2.0, 7.2.1
Action Pack is a framework for handling and responding to web requests. Starting in version 3.1.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the query parameter filtering routin…
- CVE-2024-47887MEDIUMCVSS 6.6EG 6.6fixed in 6.1.7.9, 7.0.8.5, 7.1.4.1 or 7.2.1.1, by version range2024-10-16
vulnerable: 7.2.0, 7.2.1
Action Pack is a framework for handling and responding to web requests. Starting in version 4.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in Action Controller's HTTP Token authe…
- CVE-2024-54133LOWCVSS 2.3EG 2.3fixed in 7.0.8.7, 7.1.5.1, 7.2.2.1 or 8.0.0.1, by version range2024-12-10
vulnerable: 8.0.0
Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.…
- CVE-2026-33167MEDIUMCVSS 6.1EG 6.1fixed in 8.1.2.12026-03-23
vulnerable: 8.1.0, 8.1.1, 8.1.2
Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message cou…
Check whether actionpack is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for actionpack CVEs against the assets you own.
Book a Demo →