207 Rails 6.1 LTS Changelog

Updated . Posted . Visible to the public.

November 4th 2026, Rails version 6.1.7.42

  • Backported a fix for GHSA-f3w6-w445-fwh9 - Possible arbitrary file write and read in Active Storage image analysis (ships an ImageMagick security policy for every MiniMagick process)
  • Backported a fix for GHSA-v924-7rp8-4mxh - Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing
  • Backported a fix for GHSA-wm3x-v3qw-4jh3 - Possible Strong Parameters bypass in Parameters#each_key in Action Pack
  • Backported a fix for GHSA-8474-xrp6-wh69 - Possible DoS vulnerability in Active Support safe_constantize
  • Backported a fix for GHSA-rwvh-fw6r-pwvp - Possible DoS vulnerability in Action Controller Live streaming
  • Backported a fix for GHSA-v6rj-xm57-3p59 - Possible XSS vulnerability in Action View highlight helper
  • Backported a fix for GHSA-x6mj-8jx9-qhqv - Possible sensitive session information leak in Active Storage proxy mode
  • Backported a fix for GHSA-68p9-83h6-5wpj - Possible XSS vulnerability in Action View tag helpers
  • Backported a fix for GHSA-hfr4-8rjc-97m2 - Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage
  • Backported a fix for GHSA-p2pm-g2h6-7j5j - Possible DoS vulnerability in Active Storage filename handling
  • Backported a fix for GHSA-3f4q-8x5m-76v8 - Possible local file disclosure in Active Storage video previews and analysis
  • Backported a fix for GHSA-5957-c7qm-m469 - Possible signature replay in Action Mailbox Mailgun ingress
  • Backported a fix for GHSA-2586-8ghr-69fj - Possible restoration of destroyed sessions in Action Dispatch CacheStore. The Dalli-based MemCacheStore has the same pattern; use Dalli >= 4.0.
  • Backported a fix for GHSA-gmj8-hvj3-49mw - Missing SameSite attribute on session cookies from Action Pack session stores
  • Backported a fix for GHSA-r9jg-fmfx-2gv6 - Possible cache poisoning in Action Pack content negotiation
  • Not affected: GHSA-2p2f-4rq4-gjwc, GHSA-rq8q-p985-fjq7, GHSA-3w93-6hmw-whh4, GHSA-4v2w-w6g6-f8f8, GHSA-2gff-2mmg-m73p, GHSA-2w9f-fxwj-w2qf.
  • Read the announcement Show archive.org snapshot

October 31st 2026, Rails version 6.1.7.41

  • No changes in Rails.
  • Bumped Rack version requirement to version 2.2.25.10.

October 31st 2026, Rack version 2.2.25.10

  • Applied a fix for GHSA-5v64-555j-wjxm - Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion
  • Applied a fix for GHSA-p8x9-v4hv-2w4g - Multipart boundary guard skips a leading empty or quoted boundary parameter, allowing parser differentials and WAF bypass
  • Applied a fix for GHSA-2j8w-xcrc-x985) - Rack::Request#host_with_port and #base_url return an invalid Host verbatim, enabling URL and allowlist bypass
  • Applied a fix for GHSA-wvg4-6p58-3gh3 - Rack::Static header_rules bypass via unnormalized dot segments in the request path
  • Read the announcement Show archive.org snapshot

October 27th 2026, Rails version 6.1.7.40

  • No changes in Rails.
  • Bumped Rack version requirement to version 2.2.23.12.

October 27th 2026, Rack version 2.2.23.12

October 20th 2026, Rails version 6.1.7.39 + Rack version 2.2.23.11

  • Added support for Ruby 4.0.

July 29th, 2026: Version 6.1.7.38

April 23rd 2026, Rails version 6.1.7.37

April 2nd 2026, Rails version 6.1.7.36

  • No changes in Rails.
  • Bumped Rack version requirement to version 2.2.23.10.

April 2nd 2026, Rack version 2.2.23.10

  • Backported fix for CVE-2026-34763 — Possible leak of root directory name in Rack::Directory
  • Backported fix for CVE-2026-34230 — Denial of Service in Rack when using Rack::Deflater middleware
  • Backported fix for CVE-2026-26961 — Non-RFC-conformant handling of Multipart request boundaries
  • Backported fix for CVE-2026-34786 — Possible Incorrect setting of HTTP headers in Rack::Static
  • Backported fix for CVE-2026-34831 — Possible Invalid Content-Length header in Rack::Files
  • Backported fix for CVE-2026-34826 — Possible Denial of Service in Rack handling of Range headers
  • Backported fix for CVE-2026-34835 — Missing validation of RFC-conformity of Host Header (incomplete fix, see above)
  • Backported fix for CVE-2026-34830 — Incorrect handling of X-Accel-Mapping in Rack::SendFile
  • Backported fix for CVE-2026-34785 — Possible directory traversal in Rack::Static
  • Backported fix for CVE-2026-34829 — Possible Denial of Service for multipart requests
  • Backported fix for CVE-2026-26962 — Possible mishandling of filenames in multipart requests
  • Read the announcement Show archive.org snapshot

March 24th 2026, Rails version 6.1.7.35

  • Backported fix for CVE-2026-33168 — XSS in tag helper.
  • Backported fix for CVE-2026-33169 — ReDoS in ActiveSupport.
  • Backported fix for CVE-2026-33170 — XSS in SafeBuffer.
  • Backported fix for CVE-2026-33173 — Insufficient filtering in ActiveStorage.
  • Backported fix for CVE-2026-33176 — DoS in ActiveSupport.
  • Backported fix for CVE-2026-33195 — Path Traversal in ActiveStorage.
  • Backported fix for CVE-2026-33202 — Glob injection in ActiveStorage.
  • Read the announcement Show archive.org snapshot
    • Note that the announcement mistakenly states that [CVE-2026-33174] and [CVE-2026-33658] were fixed in Rails LTS. Instead, they do not affect Rails LTS.

February 19th 2026, Rails version 6.1.7.34

  • No changes in Rails.
  • Bumped Rack version requirement to version 2.2.22.10.

February 19th 2026, Rack version 2.2.22.10

October 20th 2025, Rails version 6.1.7.33

  • No changes in Rails.
  • Bumped Rack version requirement to version 2.2.20.11.

October 20th 2025, Rack version 2.2.20.11

  • Removed an unnecessary warning caused by the last change ("unknown or unsafe x-sendfile variation"). Has no security implications.

October 13th 2025, Rails version 6.1.7.32

  • No changes in Rails.
  • Bumped Rack version requirement to version 2.2.20.10.

October 13th 2025, Rack version 2.2.20.10

October 9th 2025, Rails version 6.1.7.31

  • No changes in Rails.
  • Bumped Rack version requirement to version 2.2.19.10.

October 9th 2025, Rack version 2.2.19.10

October 1st 2025, Rails version 6.1.7.30

  • No changes in Rails.
  • Bumped Rack version requirement to version 2.2.18.10.

October 1st 2025, Rack version 2.2.18.10

August 14th 2025, Rails version 6.1.7.29

  • Backported fixes for two vulnerabilies. Read the announcement Show archive.org snapshot . This includes:

    • Dangerous transformation methods in ActiveStorage (CVE-2025-24293)
    • ANSI injection in ActiveRecord logging (CVE-2025-55193)

  • Backported a (non-CVE) fix to ActionCable logging, to filter sensitive parameters.

June 6th 2025, Rails version 6.1.7.28

  • No changes in Rails.
  • Bumped Rack version requirement to version 2.2.17.10.

June 6th 2025, Rack version 2.2.17.10

May 9th 2025, Rails version 6.1.7.27

  • No changes in Rails.
  • Bumped Rack version requirement to version 2.2.14.10.

May 9th 2025, Rack version 2.2.14.10

March 13th 2025, Rails version 6.1.7.26

  • No changes in Rails.
  • Bumped Rack version requirement to version 2.2.13.10.

March 13th, 2025, Rack version 2.2.13.10

March 11th, Rails version 6.1.7.25

March 6th 2025, Rails version 6.1.7.24

  • No changes in Rails.
  • Bumped Rack version requirement to version 2.2.12.10.

March 6th 2025, Rack version 2.2.12.10

  • Fixed CVE-2025-27111: Possible Log Injection in Rack

February 21st, Rails version 6.1.7.23

  • Bugfix: Require 'logger' library before use. This fixes a crash when upgrading to a newer version of the concurrenty-ruby gem.

February 21st, Rails version 6.1.7.22

  • No changes in Rails.
  • Bumped required Rack version to 2.2.11.10.

February 21st 2025, Rack version 2.2.11.10

  • Fixed [CVE-2025-25184]: Possible Log Injection in Rack::CommonLogger

Dezember 11th 2024, Rails version 6.1.7.21

October 17th 2024, Rails version 6.1.7.20

Sep 18th, 2024: Version 6.1.7.19

  • Reverted a dev-only bug fix breaking for users of older versions of the "listen" gem.

Sep 18th, 2024: Version 6.1.7.18

  • Initial release of the LTS version of Rails 6.1.
  • This is mostly identical to the latest official 6.1 release (6.1.7.8) plus some compatible and non-essential bug fixes.
  • Supports Ruby 2.5, 2.7, 3.1 and 3.3
  • Added monkey patches to address ReDoS vulnerabilities in the time stdlib on old Ruby versions (CVE-2023-28756), see here Show archive.org snapshot for more details (the uri changes can be solved by updating the "uri" gem)
  • Bump dependencies on rack, trix and rails-html-sanitizer to versions without known security vulnerabilities.
  • (Skipped 10 tiny versions to version .18 to stay ahead of any official 6.1.7.x community releases.)
Profile picture of Tobias Kraze
Tobias Kraze
makandra.de
Say thanks1
Last edit
Dominik Schöler
License
Source code in this card is licensed under the MIT License.
Posted by Tobias Kraze to Rails LTS documentation (2024-09-18 12:53)
This website uses short-lived cookies to improve usability.
or learn more