Denial of Service Vulnerability in Actionpack Ruby Gem by Ruby on Rails

CVE-2021-22902

What is CVE-2021-22902?

The Actionpack Ruby Gem, a critical component of the Ruby on Rails framework, contains a vulnerability that may lead to a denial of service through its Mime type parser. When an application processes specially crafted Accept headers, it can trigger catastrophic backtracking within the regular expression engine, leading to resource exhaustion. This flaw affects versions prior to 6.0.3.7 and 6.1.3.2, potentially compromising the stability of Rails applications. It is essential for developers to update to the latest versions to mitigate this risk.

References