209 List of CVEs addressed by Rails LTS

This is a list of known CVEs relevant for Rails LTS 2.3+. All CVEs are fixed in all versions of Rails LTS (or may not affect some versions). If a versions of Rails LTS is not mentioned, the fix was already done in an official release Ruby on Rails release, and is therefore also part of Rails LTS.

Start (see bottom for latest):

XSS vulnerability in the translate helper method in Ruby on Rails
- Fixed in 2.3 LTS.
Possible XSS Security Vulnerability in SafeBuffer#[]
- Rails 2.3 with up to date versions of the rails_xss plugin is not affected.
CVE-2012-1099
- Fixed in 2.3 LTS.
CVE-2012-2660
- Rails 2.3 is not affected.
CVE-2012-2661
- Rails 2.3 is not affected.
CVE-2012-2694
- Rails 2.3 is not affected.
CVE-2012-2695
- Fixed in 2.3 LTS.
CVE-2012-3424
- Rails 2.3 is not affected.
CVE-2012-3463
- Rails 2.3 is not affected.
CVE-2012-3464
- Fixed in 2.3 LTS.
CVE-2012-3465
- Fixed in 2.3 LTS.
CVE-2012-5664 (a.k.a. CVE-2012-6496)
- Fixed in 2.3 LTS.
CVE-2013-0155
- Fixed in 2.3.18.5 LTS.
CVE-2013-0156
- Fixed in 2.3.18.5 LTS.
CVE-2013-0276
- Fixed in 2.3 LTS.
CVE-2013-0277
- Fixed in 2.3 LTS.
CVE-2013-1855
- Fixed in 2.3 LTS.
CVE-2013-1856
- This is not fixed in 2.3 LTS, since Rails LTS does not support jRuby.
CVE-2013-1857
- Fixed in 2.3 LTS.
CVE-2013-1854
- Fixed in 2.3 LTS.
CVE-2013-3221
- Partially mitigated in 2.3 LTS.
- Partially mitigated in 3.2 LTS.
- See here Show archive.org snapshot for more details.
CVE-2013-4491
- Rails 2.3 is not affected.
CVE-2013-6414
- Rails 2.3 is not affected.
CVE-2013-6415
- Fixed in 2.3 LTS.
CVE-2013-6417
- Fixed in 2.3 LTS.
CVE-2013-6416
- Rails 2.3 is not affected.
CVE-2014-0080
- Rails 2.3 is not affected.
CVE-2014-0081
- Fixed in 2.3 LTS.
CVE-2014-0082
- Rails 2.3 is not affected.
CVE-2014-0130
- Fixed in 2.3 LTS.
CVE-2014-3482
- Fixed in 2.3 LTS.
CVE-2014-3483
- Rails 2.3 is not affected.
CVE-2014-3514
- Rails 2.3 is not affected.
CVE-2014-7818
- Fixed in 2.3 LTS.
CVE-2014-7829
- Rails 2.3 is not affected.
CVE-2015-1840
- Rails 2.3 is not affected.
CVE-2015-3224
- Rails 2.3 is not affected.
  use ActionDispatch::Executor
CVE-2015-3226
- Rails 2.3 is not affected.
CVE-2015-3227
- Fixed in 2.3 LTS.
Start of support for Rails 3.2 LTS. Earlier CVEs are all addressed.
CVE-2015-7576
- Rails 2.3 is not affected.
- Fixed in 3.2 LTS.
CVE-2015-7577
- Rails 2.3 is not affected.
- Fixed in 3.2 LTS.
CVE-2015-7578
- Rails 2.3 is not affected.
- Rails 3.2 is not affected.
CVE-2015-7579
- Rails 2.3 is not affected.
- Rails 3.2 is not affected.
CVE-2015-7580
- Rails 2.3 is not affected.
- Rails 3.2 is not affected.
CVE-2015-7581
- Rails 2.3 is not affected.
- Fixed in 3.2 LTS.
CVE-2016-0751
- Fixed in 2.3 LTS.
- Fixed in 3.2 LTS.
CVE-2016-0752
- Rails 2.3 is not affected.
- Fixed in 3.2 LTS.
CVE-2016-0753
- Fixed in 2.3 LTS.
- Fixed in 3.2 LTS.
CVE-2016-2097
- Fixed in 2.3 LTS.
- Fixed in 3.2 LTS.
CVE-2016-2098
- Fixed in 2.3 LTS.
- Fixed in 3.2 LTS.
CVE-2016-6316
- Rails 2.3 is not affected. A variant of this is fixed in 2.3 LTS.
- Fixed in 3.2 LTS.
CVE-2016-6317
- Rails 2.3 is not affected.
- Rails 3.2 is not affected.
CVE-2018-8048
- Rails 2.3 is not affected.
- Rails 3.2 is not affected.
CVE-2018-3760
- Rails 2.3 is not affected.
- Rails 3.2 is not affected.
CVE-2018-16468
- Rails 2.3 is not affected.
- Rails 3.2 is not affected.
CVE-2018-16471
- Fixed in Rails 2.3 / 3.2 LTS's version of Rack.
Start of support for Rails 4.2 LTS. Earlier CVEs are all addressed.
CVE-2018-16476
- Rails 2.3 is not affected.
- Rails 3.2 is not affected.
- Fixed in 4.2 LTS.
CVE-2018-16477
- Rails 2.3 is not affected.
- Rails 3.2 is not affected.
- Rails 4.2 is not affected.
CVE-2019-5418
- Fixed in 2.3 LTS.
- Fixed in 3.2 LTS.
- Fixed in 4.2 LTS.
CVE-2019-5419
- Fixed in 2.3 LTS.
- Fixed in 3.2 LTS.
- Fixed in 4.2 LTS.
CVE-2019-5420
- Rails 2.3 is not affected.
- Rails 3.2 is not affected.
- Rails 4.2 is not affected.
CVE-2019-16782 / CVE-2019-25025
- Fixed in Rails 2.3 LTS.
- Fixed in Rails 3.2 LTS.
- Vulnerability is not part of Rails 4.2 LTS. We have released a fork of activerecord-session_store Show archive.org snapshot with a fix.
CVE-2020-5267
- Fixed in Rails 2.3 LTS.
- Fixed in Rails 3.2 LTS.
- Fixed in Rails 4.2 LTS.
CVE-2020-10663
- Vulnerability is not part of Rails LTS. We advise users to upgrade to json 2.3.0 or later.
- For users who are unable to upgrade we have released a workaround Show archive.org snapshot that will patch your json gem against this vulnerability.
CVE-2020-8130
- Vulnerability is not part of Rails LTS, but we released a fix to Rails 2.3 LTS to allow users to upgrade their rake version to >= 12.3.3. Users on Ruby 1.8.7 can use our fork of rake 10.5 Show archive.org snapshot . see details Show archive.org snapshot
CVE-2020-8151
- Fixed in Rails 2.3 LTS.
- Fixed in Rails 3.2 LTS.
- Vulnerability is not part of Rails 4.2 LTS. We have forked activeresource Show archive.org snapshot with a fix.
CVE-2020-8159
- Fixed in Rails 2.3 LTS.
- Fixed in Rails 3.2 LTS.
- Vulnerability is not part of Rails 4.2 LTS. We have forked actionpack-page_caching Show archive.org snapshot with a fix.
CVE-2020-8161
- Fixed in the Rails 2.3 / 3.2 LTS's version of Rack.
- Fixed in the Rails 4.2 LTS's version of Rack.
CVE-2020-8162
- Rails 2.3 LTS is not affected.
- Rails 3.2 LTS is not affected.
- Rails 4.2 LTS is not affected.
CVE-2020-8163
- Fixed in Rails 2.3 LTS.
- Fixed in Rails 3.2 LTS.
- Fixed in Rails 4.2 LTS.
CVE-2020-8164
- Rails 2.3 LTS is not affected.
- Rails 3.2 LTS is not affected.
- Rails 4.2 LTS is not affected.
CVE-2020-8165
- Addressed in Rails 2.3 LTS. Potential code changes required Show archive.org snapshot
- Addressed in Rails 3.2 LTS. Potential code changes required Show archive.org snapshot
- Fixed in Rails 4.2 LTS.
CVE-2020-8166
- Rails 2.3 LTS is not affected.
- Rails 3.2 LTS is not affected.
- Rails 4.2 LTS is not affected.
CVE-2020-8167
- Rails 2.3 LTS is not affected.
- Rails 3.2 LTS is not affected.
- Rails 4.2 LTS is not affected.
CVE-2020-8184
- Fixed in the Rails 2.3 / 3.2 LTS's version of Rack.
- Fixed in the Rails 4.2 LTS's version of Rack.
CVE-2020-15169
- Fixed in Rails 2.3 LTS.
- Fixed in Rails 3.2 LTS.
- Fixed in Rails 4.2 LTS.
CVE-2021-22880
- Rails 2.3 LTS is not affected.
- Rails 3.2 LTS is not affected.
- Fixed in Rails 4.2 LTS.
CVE-2021-22881
- Rails 2.3 LTS is not affected.
- Rails 3.2 LTS is not affected.
- Rails 4.2 LTS is not affected.
CVE-2021-22885
- Fixed in Rails 2.3 LTS.
- Fixed in Rails 3.2 LTS.
- Fixed in Rails 4.2 LTS.
- Contains a potentially breaking change
CVE-2021-22902
- Rails 2.3 LTS is not affected.
- Rails 3.2 LTS is not affected.
- Rails 4.2 LTS is not affected.
CVE-2021-22903
- Rails 2.3 LTS is not affected.
- Rails 3.2 LTS is not affected.
- Rails 4.2 LTS is not affected.
CVE-2021-22904
- Rails 2.3 LTS is not affected.
- Rails 3.2 LTS is not affected.
- Fixed in Rails 4.2 LTS.
Start of support for Rails 5.2 LTS. Earlier CVEs are all addressed.
CVE-2022-3704
- Rails 2.3 LTS is not affected.
- Rails 3.2 LTS is not affected.
- Rails 4.2 LTS is not affected.
- Fixed in Rails 5.2 LTS.
CVE-2022-23633
- Rails 2.3 LTS is not affected.
- Rails 3.2 LTS is not affected.
- Rails 4.2 LTS is not affected.
- Fixed in Rails 5.2 LTS.
CVE-2022-21831
- Rails 2.3 LTS is not affected.
- Rails 3.2 LTS is not affected.
- Rails 4.2 LTS is not affected.
- Fixed in Rails 5.2 LTS.
CVE-2022-22577
- Rails 2.3 LTS is not affected.
- Rails 3.2 LTS is not affected.
- Rails 4.2 LTS is not affected.
- Fixed in Rails 5.2 LTS.
CVE-2022-27777
- Fixed in Rails 2.3 LTS.
- Fixed in Rails 3.2 LTS.
- Fixed in Rails 4.2 LTS.
- Fixed in Rails 5.2 LTS.
CVE-2022-30122
- Fixed in the Rails 2.3 / 3.2 LTS's version of Rack.
- Fixed in the Rails 4.2 LTS's version of Rack.
- The Rails 5.2 LTS's version of Rack is not affected.
CVE-2022-30123
- Fixed in Rails 2.3 / 3.2 LTS's version of Rack.
- Fixed in Rails 4.2 LTS's version of Rack.
- The Rails 5.2 LTS's version of Rack is not affected.
CVE-2022-31163
- Vulnerability is part of tzinfo gem.
- Updated required gem version in Rails 2.3 LTS.
- Updated required gem version in Rails 3.2 LTS.
- Updated required gem version in Rails 4.2 LTS.
- Updated required gem version in Rails 5.2 LTS.
CVE-2022-32224
- Note that this is not a vulnerability in itself, but allows attackers to escalate hypothetical other vulnerabilities ( see details Show archive.org snapshot
- Fixed in Rails 2.3 LTS for Psych >= 2.0 (which requires Ruby >= 1.9)
- Fixed in Rails 3.2 LTS for Psych >= 2.0 (which requires Ruby >= 1.9)
- Fixed in Rails 4.2 LTS.
- Fixed in Rails 5.2 LTS.
CVE-2022-44566
- Fixed in Rails 2.3 LTS.
- Fixed in Rails 3.2 LTS.
- Fixed in Rails 4.2 LTS.
- Fixed in Rails 5.2 LTS.
CVE-2022-44570
- Fixed in Rails 2.3 / 3.2 LTS's version of Rack.
- Fixed in Rails 4.2 LTS's version of Rack.
- Fixed in Rails 5.2 LTS's version of Rack.
CVE-2022-44571
- Fixed in Rails 2.3 / 3.2 LTS's version of Rack.
- Fixed in Rails 4.2 LTS's version of Rack.
- Fixed in Rails 5.2 LTS's version of Rack.
CVE-2022-44572
- Does not affect Rails 2.3 / 3.2 LTS's version of Rack.
- Does not affect Rails 4.2 LTS's version of Rack.
- Fixed in Rails 5.2 LTS's version of Rack.
CVE-2023-22792
- Rails 2.3 LTS is not affected.
- Fixed in Rails 3.2 LTS.
- Fixed in Rails 4.2 LTS.
- Fixed in Rails 5.2 LTS.
CVE-2023-22794
- Rails 2.3 LTS is not affected.
- Rails 3.2 LTS is not affected.
- Rails 4.2 LTS is not affected.
- Rails 5.2 LTS is not affected.
CVE-2023-22795
- Rails 2.3 LTS is not affected.
- Rails 3.2 LTS is not affected.
- Fixed in Rails 4.2 LTS.
- Fixed in Rails 5.2 LTS.
CVE-2023-22796
- Fixed in Rails 2.3 LTS.
- Fixed in Rails 3.2 LTS.
- Fixed in Rails 4.2 LTS.
- Fixed in Rails 5.2 LTS.
CVE-2023-22797
- Rails 2.3 LTS is not affected.
- Rails 3.2 LTS is not affected.
- Rails 4.2 LTS is not affected.
- Rails 5.2 LTS is not affected.
CVE-2023-22799
- This affects the globalid gem. Fixed in globalid 1.0.1. Addtionally:
- Does not affect Rails 2.3 LTS apps.
- Does not affect Rails 3.2 LTS apps.
- Rails 4.2 LTS includes a monkey-patch fixing this vulnerability.
- Rails 5.2 LTS includes a monkey-patch fixing this vulnerability.
CVE-2023-23913
- This affects the jquery-ujs / prototype-ujs / rails-ujs gems / npm packages which are not part of Rails LTS itself. We will try to provide a fix in the future.
- Rails 2.3 LTS is not affected.
- Unfixed for Rails 3.2 LTS when using the jquery-rails gem or jquery_ujs npm package.
- Unfixed for Rails 4.2 LTS when using the jquery-rails gem or jquery_ujs npm package.
- Fixed for Rails 5.2 LTS when using the bundled rails_ujs using the asset pipeline.
- Unfixed for Rails 5.2 LTS when using the rails-ujs npm package.
CVE-2023-27530
- Fixed in Rails 2.3 / 3.2 LTS's version of Rack.
- Fixed in Rails 4.2 LTS's version of Rack.
- Fixed in Rails 5.2 LTS's version of Rack.
CVE-2023-27539
- Fixed in Rails 2.3 / 3.2 LTS's version of Rack.
- Fixed in Rails 4.2 LTS's version of Rack.
- Fixed in Rails 5.2 LTS's version of Rack.
CVE-2023-28120
- Rails 2.3 LTS is unaffected.
- Fixed in Rails 3.2 LTS.
- Fixed in Rails 4.2 LTS.
- Fixed in Rails 5.2 LTS.
CVE-2023-28755
- This is an issue in Ruby / the uri library.
- Rails 2.3 LTS includes a monkey-patch.
- Rails 3.2 LTS includes a monkey-patch.
- Rails 4.2 LTS includes a monkey-patch.
- Rails 5.2 LTS includes a monkey-patch.
CVE-2023-28756
- This is an issue in Ruby / the time library.
- Rails 2.3 LTS includes a monkey-patch.
- Rails 3.2 LTS includes a monkey-patch.
- Rails 4.2 LTS includes a monkey-patch.
- Rails 5.2 LTS includes a monkey-patch.
CVE-2023-28362
- This is a XSS issue in Rails' redirect_to method
- Fixed in Rails 2.3 LTS.
- Fixed in Rails 3.2 LTS.
- Fixed in Rails 4.2 LTS.
- Fixed in Rails 5.2 LTS.
CVE-2023-38037
- This is an issue with ActiveSupport::EncryptedFile
- Rails 2.3 LTS is not affected.
- Rails 3.2 LTS is not affected.
- Rails 4.2 LTS is not affected.
- Fixed in Rails 5.2 LTS.
CVE-2024-25126
- This is a ReDoS vulnerability in Rack.
- Fixed in Rails 2.3 / 3.2 LTS's version of Rack.
- Fixed in Rails 4.2 LTS's version of Rack.
- Fixed in Rails 5.2 LTS's version of Rack.
CVE-2024-26141
- This is a DoS vulnerability in Rack.
- Fixed in Rails 2.3 / 3.2 LTS's version of Rack.
- Fixed in Rails 4.2 LTS's version of Rack.
- Fixed in Rails 5.2 LTS's version of Rack.
CVE-2024-26142
- This is a ReDoS vulnerability in ActionDispatch.
- Rails 2.3 LTS is not affected.
- Rails 3.2 LTS is not affected.
- Rails 4.2 LTS is not affected.
- Rails 5.2 LTS is not affected.
CVE-2024-26143
- This is an XSS vulnerabilty in ActionController.
- Rails 2.3 LTS is not affected.
- Rails 3.2 LTS is not affected.
- Rails 4.2 LTS is not affected.
- Rails 5.2 LTS is not affected.
CVE-2024-26144
- This is a session information leak in ActiveStorage.
- Rails 2.3 LTS is not affected.
- Rails 3.2 LTS is not affected.
- Rails 4.2 LTS is not affected.
- Rails 5.2 LTS is not affected.
CVE-2024-26146
- This is a ReDoS vulnerability in Rack.
- Fixed in Rails 2.3 / 3.2 LTS's version of Rack.
- Fixed in Rails 4.2 LTS's version of Rack.
- Fixed in Rails 5.2 LTS's version of Rack.
Start of support for Rails 6.1 LTS. Earlier CVEs are all addressed.
CVE-2024-41128
- This is a ReDoS vulnerability in query parameter filtering in ActionDispatch.
- Rails 2.3 LTS is not affected
- Fixed in Rails 3.2 LTS
- Fixed in Rails 4.2 LTS
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
CVE-2024-47887
- This is a ReDoS vulnerability in the HTTP token authentication in ActionController.
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Fixed in Rails 4.2 LTS
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
CVE-2024-47888
- This is a ReDoS vulnerability in ActionText's plaintext_for_blockquote_node.
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Rails 5.2 LTS is not affected
- Fixed in Rails 6.1 LTS
CVE-2024-47889
- This is a ReDoS vulnerability in ActionMailer's block_format method.
- Fixed in Rails 2.3 LTS
- Fixed in Rails 3.2 LTS
- Fixed in Rails 4.2 LTS
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
CVE-2024-54133
- Possible Content Security Policy bypass in Action Dispatch.
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
CVE-2024-53847
- Trix editor subject to XSS vulnerabilities on copy & paste.
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Rails 5.2 LTS is not affected
- Rails 6.1 LTS is not affected
CVE-2025-24293
- Dangerous transformation methods in ActiveStorage
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
CVE-2025-25184
- Possible Log Injection in Rack::CommonLogger
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2025-27111
- Possible Log Injection in Rack
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2025-27610
- Local File Inclusion in Rack::Static
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2025-32411
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2025-46727
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2025-49007
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2025-55193
- ANSI injection in ActiveRecord logging
- Fixed in Rails 2.3 LTS
- Fixed in Rails 3.2 LTS
- Fixed in Rails 4.2 LTS
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
CVE-2025-59830
- Rack has an unsafe default in Rack::QueryParser that allows params_limit bypass via semicolon-separated parameters.
- Rack for 2.3 LTS is not affected
- Rack for 3.2 LTS is not affected
- Rack for 4.2 LTS is not affected
- Rack for 5.2 LTS is not affected
- Rack for 6.1 LTS is not affected
CVE-2025-61770
- Unbounded multipart preamble buffering enables DoS (memory exhaustion)
- Rack for 2.3 LTS ist not affected.
- Rack for 3.2 LTS ist not affected.
- Rack for 4.2 LTS ist not affected.
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2025-61771
- Multipart parser buffers large non‑file fields entirely in memory, enabling DoS
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2025-61772
- Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2025-61919
- Unbounded read in Rack::Request form parsing can lead to memory exhaustion
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2025-61780
- Rack has a Possible Information Disclosure Vulnerability
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2026-25500
- Rack has a XSS Vulnerability in Rack::Directory
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2026-22860
- Directory Traversal vulnerability in Rack::Directory.
- Rack for Rails 2.3 LTS is not vulnerable.
- Rack for Rails 3.2 LTS is not vulnerable.
- Rack for Rails 4.2 LTS is not vulnerable.
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2026-33167
- XSS in Rails error page
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Rails 5.2 LTS is not affected
- Rails 6.1 LTS is not affected
CVE-2026-33168
- XSS in tag helper
- Fixed in Rails 2.3 LTS
- Fixed in Rails 3.2 LTS
- Fixed in Rails 4.2 LTS
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
CVE-2026-33169
- ReDoS in ActiveSupport
- Fixed in Rails 2.3 LTS
- Fixed in Rails 3.2 LTS
- Fixed in Rails 4.2 LTS
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
CVE-2026-33170
- XSS in SafeBuffer
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Fixed in Rails 4.2 LTS
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
CVE-2026-33173
- Insufficient filtering in ActiveStorage
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
CVE-2026-33174
- DoS in ActiveStorage
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Rails 5.2 LTS is not affected
- Rails 6.1 LTS is not affected
CVE-2026-33176
- DoS in ActiveSupport
- Fixed in Rails 2.3 LTS
- Fixed in Rails 3.2 LTS
- Fixed in Rails 4.2 LTS
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
CVE-2026-33195
- Path Traversal in ActiveStorage
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
CVE-2026-33202
- Glob injection in ActiveStorage
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
CVE-2026-33658
- DoS in ActiveStorage
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Rails 5.2 LTS is not affected
- Rails 6.1 LTS is not affected
CVE-2026-26961
- Non-RFC-conformant handling of Multipart request boundaries
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2026-26962
- Possible mishandling of filenames in multipart requests
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2026-32762
- Possible bypass of Host Authorization via Forwarded Header
- Rack for Rails 2.3 LTS is not vulnerable.
- Rack for Rails 3.2 LTS is not vulnerable.
- Rack for Rails 4.2 LTS is not vulnerable.
- Rack for Rails 5.2 LTS is not vulnerable.
- Rack for Rails 6.1 LTS is not vulnerable.
CVE-2026-34230
- Denial of Service in Rack when using Rack::Deflater middleware
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2026-34763
- Possible leak of root directory name in Rack::Directory
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2026-34785
- Possible directory traversal in Rack::Static
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2026-34786
- Possible Incorrect setting of HTTP headers in Rack::Static
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2026-34826
- Possible Denial of Service in Rack handling of Range headers
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2026-34827
- Possible Denial of Service for multipart requests
- Rack for Rails 2.3 LTS is not vulnerable.
- Rack for Rails 3.2 LTS is not vulnerable.
- Rack for Rails 4.2 LTS is not vulnerable.
- Rack for Rails 5.2 LTS is not vulnerable.
- Rack for Rails 6.1 LTS is not vulnerable.
CVE-2026-34829
- Possible Denial of Service for multipart requests
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2026-34830
- Incorrect handling of X-Accel-Mapping in Rack::SendFile
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2026-34831
- Possible Invalid Content-Length header in Rack::Files
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
CVE-2026-34835
- Missing validation of RFC-conformity of Host Header
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
Start of support for Rails 7.2 LTS. Earlier CVEs are all addressed.
CVE-2026-41316
- RCE gagdet in ERB gem
- Fixed in Rails 2.3 LTS
- Fixed in Rails 3.2 LTS
- Fixed in Rails 4.2 LTS
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
- Fixed in Rails 7.2 LTS
CVE-2026-66066
- Untrusted formats in libvips image processing
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Rails 5.2 LTS is not affected
- Fixed in Rails 6.1 LTS
- Fixed in Rails 7.2 LTS
GHSA-5v64-555j-wjxm
- Rack: Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion
- Rack for Rails 2.3 LTS is not vulnerable.
- Rack for Rails 3.2 LTS is not vulnerable.
- Rack for Rails 4.2 LTS is not vulnerable.
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
- Rails 7.2 LTS requires Rack >= 2.2.25, which contains the fix
GHSA-p8x9-v4hv-2w4g
- Rack: Multipart boundary guard skips a leading empty or quoted boundary parameter, allowing parser differentials and WAF bypass
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
- Rails 7.2 LTS requires Rack >= 2.2.25, which contains the fix
GHSA-2j8w-xcrc-x985
- Rack: Rack::Request#host_with_port and #base_url return an invalid Host verbatim, enabling URL and allowlist bypass
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
GHSA-wvg4-6p58-3gh3
- Rack: Rack::Static header_rules bypass via unnormalized dot segments in the request path
- Fixed in Rack for Rails 2.3 LTS
- Fixed in Rack for Rails 3.2 LTS
- Fixed in Rack for Rails 4.2 LTS
- Fixed in Rack and Rails 5.2 LTS
- Fixed in Rack and Rails 6.1 LTS
- Rails 7.2 LTS requires Rack >= 2.2.25, which contains the fix
GHSA-f3w6-w445-fwh9
- Possible arbitrary file write and read in Active Storage image analysis
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
- Fixed in Rails 7.2 LTS
GHSA-v924-7rp8-4mxh
- Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
- Fixed in Rails 7.2 LTS
GHSA-wm3x-v3qw-4jh3
- Possible Strong Parameters bypass in Parameters#each_key in Action Pack
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Rails 5.2 LTS is not affected
- Fixed in Rails 6.1 LTS
- Fixed in Rails 7.2 LTS
GHSA-8474-xrp6-wh69
- Possible DoS vulnerability in Active Support safe_constantize
- Rails 2.3 LTS is not affected
- Fixed in Rails 3.2 LTS
- Fixed in Rails 4.2 LTS
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
- Fixed in Rails 7.2 LTS
GHSA-rwvh-fw6r-pwvp
- Possible DoS vulnerability in Action Controller Live streaming
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Fixed in Rails 4.2 LTS
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
- Fixed in Rails 7.2 LTS
GHSA-v6rj-xm57-3p59
- Possible XSS vulnerability in Action View highlight helper
- Rails 2.3 LTS is not affected
- Fixed in Rails 3.2 LTS
- Fixed in Rails 4.2 LTS
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
- Fixed in Rails 7.2 LTS
GHSA-2p2f-4rq4-gjwc
- Possible XSS vulnerability in Action View text helpers
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Rails 5.2 LTS is not affected
- Rails 6.1 LTS is not affected
- Fixed in Rails 7.2 LTS (update Nokogiri to >= 1.19.5 where possible; on older Nokogiri the affected helpers fall back to the HTML4 sanitizer)
GHSA-x6mj-8jx9-qhqv
- Possible sensitive session information leak in Active Storage proxy mode
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Fixed in Rails 4.2 LTS
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
- Fixed in Rails 7.2 LTS
GHSA-rq8q-p985-fjq7
- Possible XSS vulnerability in Action View strip_tags
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Rails 5.2 LTS is not affected
- Rails 6.1 LTS is not affected
- Fixed in Rails 7.2 LTS
GHSA-68p9-83h6-5wpj
- Possible XSS vulnerability in Action View tag helpers
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Rails 5.2 LTS is not affected
- Fixed in Rails 6.1 LTS
- Fixed in Rails 7.2 LTS
GHSA-3w93-6hmw-whh4
- Unsigned Content-Type in Active Storage GCS direct uploads with cache_control
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Rails 5.2 LTS is not affected
- Rails 6.1 LTS is not affected
- Fixed in Rails 7.2 LTS
GHSA-hfr4-8rjc-97m2
- Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
- Fixed in Rails 7.2 LTS
GHSA-p2pm-g2h6-7j5j
- Possible DoS vulnerability in Active Storage filename handling
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
- Fixed in Rails 7.2 LTS
GHSA-2586-8ghr-69fj
- Possible restoration of destroyed sessions in Action Dispatch CacheStore. Rails LTS applies the same fix to its own MemCacheStore (2.3, 3.2) and to the bundled Rack::Session::Memcache (2.3, 3.2, 4.2). Dalli >= 4.0 fixes it, Rails 4.2 applications should use the bundled Rack::Session::Memcache instead.
- Fixed in Rails 2.3 LTS and Rack for Rails 2.3 LTS
- Fixed in Rails 3.2 LTS and Rack for Rails 3.2 LTS
- Fixed in Rails 4.2 LTS and Rack for Rails 4.2 LTS
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
- Fixed in Rails 7.2 LTS
GHSA-r9jg-fmfx-2gv6
- Possible cache poisoning in Action Pack content negotiation
- Fixed in Rails 6.1 LTS
- Fixed in Rails 7.2 LTS
GHSA-3f4q-8x5m-76v8
- Possible local file disclosure in Active Storage video previews and analysis
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Fixed in Rails 5.2 LTS
- Fixed in Rails 6.1 LTS
- Fixed in Rails 7.2 LTS
GHSA-5957-c7qm-m469
- Possible signature replay in Action Mailbox Mailgun ingress
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Rails 5.2 LTS is not affected
- Fixed in Rails 6.1 LTS
- Fixed in Rails 7.2 LTS
GHSA-gmj8-hvj3-49mw
- Missing SameSite attribute on session cookies from Action Pack session stores
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Rails 5.2 LTS is not affected
- Fixed in Rails 6.1 LTS
- Fixed in Rails 7.2 LTS
GHSA-4v2w-w6g6-f8f8
- Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming
- Rails 2.3 LTS is not affected
- Rails 3.2 LTS is not affected
- Rails 4.2 LTS is not affected
- Rails 5.2 LTS is not affected
- Rails 6.1 LTS is not affected
- Rails 7.2 LTS is not affected
GHSA-2gff-2mmg-m73p
- Possible IP spoofing in Action Dispatch RemoteIp (Rails 8.1 only)
- No version of Rails LTS is affected
GHSA-2w9f-fxwj-w2qf
- Possible XSS vulnerability in Active Support MessagePack serializer (Rails 8.1 only)
- No version of Rails LTS is affected

Tobias Kraze

makandra.de

Say thanks

Last edit

2026-11-04

Dominik Schöler

License

Source code in this card is licensed under the MIT License.

Posted by Tobias Kraze to Rails LTS documentation (2020-02-24 11:17)