CVE-2026-126080 Active Support: Possible DoS vulnerability in Active Support safe_constantize

This vulnerability is rated as Important because an unauthenticated remote attacker can crash the application server by providing malicious channel subscription parameters to exposed Action Cable endpoints, causing a persistent denial of service. The impact primarily threatens availability in deployments that permit unauthenticated connections to Action Cable endpoints. Services that disable Action Cable or enforce strict user verification prior to channel subscription face significantly reduced exposure.

For applications that do not require Action Cable functionality, disable the endpoint by setting the mount path to nil in the application configuration:

config.action_cable.mount_path = nil

For applications requiring Action Cable, enforce authentication by rejecting unauthorized connections in the connection handler:

# In app/channels/application_cable/connection.rb

module ApplicationCable

class Connection < ActionCable::Connection::Base

def connect

reject_unauthorized_connection unless current_user

end

end

end

Caveats: Disabling the mount path disables all Action Cable WebSocket endpoints. Enforcing authentication limits exposure to verified users only and does not eliminate risk from untrusted authenticated users.

Warning: Modifying application configuration or channel connection files requires restarting the application service to take effect.