Denial of Service Risk in Action Pack Framework by Rails
CVE-2026-126072
What is CVE-2026-126072?
The Action Pack framework for handling web requests contains a vulnerability that can lead to denial of service (DoS) if not addressed. In versions prior to 8.1.4.1 and 8.0.5.2, the ActionController::Live::Buffer#close function improperly manages its end-of-stream marker. This can cause blocked operations when clients cease reading and the queue is full, leading to potential thread exhaustion as the server threads wait indefinitely. Applications utilizing ActionController::Live for streaming responses, as well as those using Active Storage proxy mode for serving large files, may be inadvertently exposed to unauthorized access due to this flaw. It is crucial for developers to upgrade to the latest versions to mitigate this risk.
Affected Version(s)
rails >= 8.1, < 8.1.4.1 < 8.1, 8.1.4.1
rails < 8.0.5.2 < 8.0.5.2