cve.bz

CVE-2021-22880

7.5 highEPSS 4.4%

High (7.5). EPSS 4.4% chance of exploitation in the next 30 days. Fixed in activerecord 5.2.4.5, 6.0.3.5, 6.1.2.1.

The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
4.4% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
CWE
CWE-400
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-8hc4-xxm3-5pppRubyGemsactiverecord>=5.0.0 <5.2.4.55.2.4.5
GHSA-8hc4-xxm3-5pppRubyGemsactiverecord>=6.0.0 <6.0.3.56.0.3.5
GHSA-8hc4-xxm3-5pppRubyGemsactiverecord>=6.1.0 <6.1.2.16.1.2.1

References

Check your stackJSON