Active Support (< 8.0.5.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/active-support--8.0.5.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 11:52:06 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgActive Support: Denial of Service via safe_constantize (CVE-2026-126080)https://feed.craftedsignal.io/briefs/2026-11-active-support-dos-ghsa-8474-xrp6-wh69/Wed, 11 Nov 2026 11:52:06 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-active-support-dos-ghsa-8474-xrp6-wh69/An unescaped regular expression in Active Support’s safe_constantize method allows unauthenticated remote attackers to trigger a server process crash via Action Cable, resulting in a Denial of Service.Active Support's safe_constantize method contains a vulnerability where untrusted input passed into constant lookup can trigger a server-side crash due to unescaped regular expression compilation when a LoadError occurs. In default Rails configurations, the Action Cable endpoint passes unsanitized input to this method, allowing unauthenticated remote attackers to trigger a Denial of Service by causing the application process to crash.

Impact

Crafted inputs to safe_constantize can exploit defects in Ruby's regular expression compiler, causing the server process to crash. Repeated requests lead to sustained application unavailability.

Recommendation

  • Upgrade activesupport to version 8.0.5.2 or 8.1.4.1 to include the patched logic that uses literal string matching.
  • For applications that do not require Action Cable, set config.action_cable.mount_path = nil to disable the vulnerable endpoint.
  • For applications utilizing Action Cable, implement reject_unauthorized_connection within ApplicationCable::Connection#connect to restrict access to authenticated users.
]]>lowadvisory