Cache Poisoning Vulnerability in Action Pack for Ruby on Rails
CVE-2026-126073
What is CVE-2026-126073?
A vulnerability exists in Action Pack, a framework used for handling web requests in Ruby on Rails. In versions prior to 8.1.4.1 and 8.0.5.2, Action Pack improperly manages response headers based on certain request headers. This flaw can result in cache poisoning, where a shared cache may return incorrect representations of content to users based on previous requests. Specifically, when responses lack the appropriate Vary headers, they may serve cached content to clients that request a different representation. This can potentially deprive users of the correct page layout or serve raw data formats. The issue is addressed in the updated versions, ensuring proper response header handling.
Affected Version(s)
rails >= 8.1, < 8.1.4.1 < 8.1, 8.1.4.1
rails < 8.0.5.2 < 8.0.5.2