{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3arubyonrailsactivesupportruby/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rubyonrails:activesupport:*:*:*:*:*:ruby:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-126080"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Active Support (\u003c 8.0.5.2)","Active Support (\u003e= 8.1, \u003c 8.1.4.1)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Ruby on Rails"],"content_html":"\u003cp\u003eActive Support's \u003ccode\u003esafe_constantize\u003c/code\u003e method contains a vulnerability where untrusted input passed into constant lookup can trigger a server-side crash due to unescaped regular expression compilation when a \u003ccode\u003eLoadError\u003c/code\u003e occurs. In default Rails configurations, the Action Cable endpoint passes unsanitized input to this method, allowing unauthenticated remote attackers to trigger a Denial of Service by causing the application process to crash.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eCrafted inputs to \u003ccode\u003esafe_constantize\u003c/code\u003e can exploit defects in Ruby's regular expression compiler, causing the server process to crash. Repeated requests lead to sustained application unavailability.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003eactivesupport\u003c/code\u003e to version 8.0.5.2 or 8.1.4.1 to include the patched logic that uses literal string matching.\u003c/li\u003e\n\u003cli\u003eFor applications that do not require Action Cable, set \u003ccode\u003econfig.action_cable.mount_path = nil\u003c/code\u003e to disable the vulnerable endpoint.\u003c/li\u003e\n\u003cli\u003eFor applications utilizing Action Cable, implement \u003ccode\u003ereject_unauthorized_connection\u003c/code\u003e within \u003ccode\u003eApplicationCable::Connection#connect\u003c/code\u003e to restrict access to authenticated users.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T11:52:06Z","date_published":"2026-11-11T11:52:06Z","id":"https://feed.craftedsignal.io/briefs/2026-11-active-support-dos-ghsa-8474-xrp6-wh69/","summary":"An unescaped regular expression in Active Support’s safe_constantize method allows unauthenticated remote attackers to trigger a server process crash via Action Cable, resulting in a Denial of Service.","title":"Active Support: Denial of Service via safe_constantize (CVE-2026-126080)","url":"https://feed.craftedsignal.io/briefs/2026-11-active-support-dos-ghsa-8474-xrp6-wh69/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:rubyonrails:activesupport:*:*:*:*:*:ruby:*:*","version":"https://jsonfeed.org/version/1.1"}