Active Support: Denial of Service via safe_constantize (CVE-2026-126080)

Active Support's safe_constantize method contains a vulnerability where untrusted input passed into constant lookup can trigger a server-side crash due to unescaped regular expression compilation when a LoadError occurs. In default Rails configurations, the Action Cable endpoint passes unsanitized input to this method, allowing unauthenticated remote attackers to trigger a Denial of Service by causing the application process to crash.

Impact

Crafted inputs to safe_constantize can exploit defects in Ruby's regular expression compiler, causing the server process to crash. Repeated requests lead to sustained application unavailability.

Recommendation

• Upgrade activesupport to version 8.0.5.2 or 8.1.4.1 to include the patched logic that uses literal string matching.
• For applications that do not require Action Cable, set config.action_cable.mount_path = nil to disable the vulnerable endpoint.
• For applications utilizing Action Cable, implement reject_unauthorized_connection within ApplicationCable::Connection#connect to restrict access to authenticated users.