UBUNTU-CVE-2026-126080: Medium severity ubuntu/rails vulnerability
Active Support is a collection of utility classes and standard library extensions used by Rails and other Ruby projects. Prior to 8.1.4.1 and 8.0.5.2, when constant lookup raises LoadError, ActiveSupport::Inflector#safeconstantize (and String#safeconstantize) builds a regular expression from the requested constant name without escaping it, so a caller that passes untrusted input lets the attacker choose the source of a pattern that the application compiles. Crafted patterns can trigger defects in Ruby's regular expression compiler, possibly leading to a crash of the server process, and repeated requests could keep the application unavailable. Action Cable passes the channel value of each subscribe command to safeconstantize before any channel lookup, so an unauthenticated client can reach this code when the application mounts Action Cable and accepts connections from untrusted clients without an added authentication check. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Active Supportto a version that resolves this vulnerability.Fixed in 8.1.4.1 - Upgrade
Upgrade
Active Supportto a version that resolves this vulnerability.Fixed in 8.0.5.2
Event History
Frequently Asked Questions
Which deployments are most exposed to unauthenticated exploitation?
Applications that mount Action Cable and accept connections from untrusted clients without an added authentication check are exposed. An unauthenticated client can supply a channel value in a subscribe command that reaches safe_constantize before channel lookup.
What does an attacker need to do to trigger the issue?
The attacker needs a path where untrusted input is passed to ActiveSupport::Inflector#safe_constantize or String#safe_constantize. Through Action Cable, a crafted channel value in a subscribe command provides such a path when unauthenticated connections are accepted.
What is the likely impact of successful exploitation?
Crafted constant names can produce regular expressions that trigger defects in Ruby's regular expression compiler, potentially crashing the server process. Repeated requests could keep the application unavailable.
What versions contain the fix?
The issue is fixed in Active Support versions 8.1.4.1 and 8.0.5.2. Versions prior to those releases are affected under the described conditions.
What mitigation is available if updating cannot happen immediately?
Add an authentication check for Action Cable connections and avoid passing untrusted input to safe_constantize. This prevents unauthenticated clients from reaching the described Action Cable path.