PT-2021-4061 · Ruby+1 · Action Pack+1

Published 2021-05-01 · Updated 2025-09-29 · CVE-2021-22902

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions actionpack ruby gem versions 6.0.0 through 6.0.3.6 actionpack ruby gem versions 6.1.0 through 6.1.3.1

Description The issue is related to a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine. This can lead to an uncontrolled consumption of resources, potentially allowing a remote attacker to cause a denial of service.

Recommendations For actionpack ruby gem versions 6.0.0 through 6.0.3.6, apply the provided patch 6-0-Prevent-catastrophic-backtracking-during-mime-parsin.patch to prevent catastrophic backtracking during mime parsing. For actionpack ruby gem versions 6.1.0 through 6.1.3.1, apply the provided patch 6-1-Prevent-catastrophic-backtracking-during-mime-parsin.patch to prevent catastrophic backtracking during mime parsing. As a temporary workaround, consider using the monkey patch placed in an initializer to work around the issue.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALSA-2025_16880

ALT-PU-2021-2595

ALT-PU-2023-4268

ALT-PU-2024-7814

BDU:2021-04601

CVE-2021-22902

GHSA-G8WW-46X2-2P65

OPENSUSE-SU-2024:11318-1

OPENSUSE-SU-2024:11821-1

RHSA-2021:4702

Affected Products

Alt Linux

Action Pack

References · 31

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22902.yml · Exploit
• 🔥 https://discuss.rubyonrails.org/t/cve-2021-22902-possible-denial-of-service-vulnerability-in-action-dispatch/77866 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-22902 · Security Note
• https://osv.dev/vulnerability/GHSA-g8ww-46x2-2p65 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-22902 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-22902 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04601 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22902 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-22902 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-22902 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11821-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-22902 · Vendor Advisory
• https://github.com/rails/rails/releases/tag/v6.1.3.2 · Note
• https://github.com/rails/rails/releases/tag/v6.0.3.7 · Note
• https://github.com/rails/rails/commit/446afbd15360a347c923ca775b21a286dcb5297a · Note