cve.bz

CVE-2021-22904

7.5 highEPSS 4.9%

High (7.5) in rubyonrails rails. EPSS 4.9% chance of exploitation in the next 30 days. Fixed in actionpack 5.2.4.6, 5.2.6, 6.0.3.7.

The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
4.9% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CWE
CWE-400
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-7wjx-3g7j-8584RubyGemsactionpack>=6.0.0 <6.0.3.76.0.3.7
GHSA-7wjx-3g7j-8584RubyGemsactionpack>=6.1.0 <6.1.3.26.1.3.2
GHSA-7wjx-3g7j-8584RubyGemsactionpack>=5.2.5 <5.2.65.2.6
GHSA-7wjx-3g7j-8584RubyGemsactionpack>=4.0.0 <5.2.4.65.2.4.6

References

Check your stackJSON