UBUNTU-CVE-2026-126072: Medium severity ubuntu/rails vulnerability
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionController::Live::Buffer#close pushes its end-of-stream marker onto the response's bounded queue while it holds the buffer's monitor. When the client has stopped reading and the queue is full, the push blocks, and Buffer#abort, which runs when the client disconnects or a write times out, waits indefinitely for the same monitor. Each such response could permanently hold a web server thread and its ActionController::Live thread, possibly resulting in a DoS vulnerability through thread exhaustion. Applications that stream responses with ActionController::Live, including sendstream, are affected. Applications that serve large files through Active Storage proxy mode are exposed to unauthenticated clients. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Action Packto a version that resolves this vulnerability.Fixed in 8.1.4.1 - Upgrade
Upgrade
Action Packto a version that resolves this vulnerability.Fixed in 8.0.5.2
Event History
Frequently Asked Questions
Which deployments are most exposed to unauthenticated denial-of-service attempts?
Applications serving large files through Active Storage proxy mode are exposed to unauthenticated clients. Any application streaming responses with ActionController::Live, including send_stream, is affected.
What conditions are needed to trigger thread exhaustion?
A client must stop reading while the response's bounded queue is full. This can cause each affected response to permanently hold both a web server thread and its ActionController::Live thread.
Are non-streaming Rails responses affected?
The provided information identifies applications that stream responses with ActionController::Live, including send_stream, as affected. It does not identify ordinary non-streaming responses as affected.
What versions contain the fix?
The issue is fixed in Rails versions 8.1.4.1 and 8.0.5.2. Versions prior to those releases are affected according to the advisory.