CVE-2009-3086
rubyonrails rails: no CVSS score yet. EPSS 2.2% chance of exploitation in the next 30 days. Fixed in actionpack 2.2.3, 2.3.4.
A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.
- EPSS
- 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rubyonrails:rails
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-fg9w-g6m4-557j | RubyGems | actionpack | >=2.1.0 <2.2.3 | 2.2.3 |
| GHSA-fg9w-g6m4-557j | RubyGems | actionpack | >=2.3.0 <2.3.4 | 2.3.4 |
| GHSA-fg9w-g6m4-557j | RubyGems | activesupport | >=2.1.0 <2.2.3 | 2.2.3 |
| GHSA-fg9w-g6m4-557j | RubyGems | activesupport | >=2.3.0 <2.3.4 | 2.3.4 |