String elements in polymorphic route arrays can trigger unexpected helper calls and leak secrets; Rails LTS blocks them by default, with an opt-out for compatibility.

Rails LTS security handling relies on public disclosure, multi-person patch review, tests, restricted access, and hardened infrastructure for vulnerable versions.

Rails LTS works with Ruby 3.3 and below, but upgrading Ruby still needs manual fixes for gems, keyword arguments, YAML loading, and standard-library changes.

Security backports for legacy Ruby releases address OpenSSL hostname verification and floating-point parsing vulnerabilities in Ruby 1.8.7 and 1.9.3.

Rails LTS 2.3 can break render_template expectations in controller specs because of rspec-rails 1.x monkey-patching. A compatibility fork of rspec-rails 1.3 restores the behavior.

Rails 3.2 LTS can break RSpec 2 controller specs with NoMethodError: undefined method [] for nil:NilClass; a compatibility fork of rspec-rails 2.14 restores them.

ReDoS in Rails LTS Active Record can let crafted requests burn excessive CPU time when user input reaches queries using .includes, especially on large POST bodies.

Rails LTS switches ActiveRecord YAML deserialization to YAML.safe_load to reduce remote code execution risk from poisoned serialized columns; unsupported classes may now raise exceptions.

Security-fixed forked packages replace vulnerable rails-ujs and jquery-ujs installs after CVE-2023-23913, with NPM and Git-based gem options for Rails apps.

Rack is now a core gem of Rails LTS, with maintained patched versions for supported Ruby and Rails releases; upgrading via the LTS gem server is recommended.