Ruby on Rails Action Pack: Denial of service in ActionController::Live streaming
Summary
Action Pack, the request handling component of Ruby on Rails, can block a web server thread and its ActionController::Live thread when a client stops reading a streamed response while the buffer queue is full. The buffer's close and abort methods can wait indefinitely for the same lock, so each affected response can hold threads permanently. Repeated requests can exhaust threads and cause a denial of service. Applications that use ActionController::Live (including send_stream) are affected, and applications that serve large files through Active Storage proxy mode are exposed to unauthenticated clients.
Affected
- rails actionpack >= 8.1, < 8.1.4.1
- rails actionpack < 8.0.5.2
- Rails 7.x and older: no fix published, treat as unpatched
Fixed in
- actionpack 8.1.4.1
- actionpack 8.0.5.2
Workaround
- No configuration-level workaround is documented by the vendor.
- Upgrading is the fix; the vendor patch commits can be applied if an immediate upgrade is not possible.
Exploitation
- No evidence of exploitation known at time of writing.
- The vendor advisory credits automated discovery (Anthropic OSS Scanner).
- No public proof of concept found.
Our recommendation
- Inventory Rails applications and versions, including use of ActionController::Live and Active Storage proxy mode.
- Upgrade to 8.1.4.1; use 8.0.5.2 only as a short bridge, since 8.0 security support ends 7 November 2026.
- Prioritise internet-facing applications that stream responses or proxy Active Storage files.
- Plan migration for any Rails 7.x or older application, which has no fix.
- Monitor application thread usage and restart behaviour for signs of exhaustion.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-rwvh-fw6r-pwvp github.com
- Rails 8.0.5.2 release github.com
- Rails 8.1.4.1 release github.com
- Patch commit 8.1 (ccbfc09) github.com
- Patch commit 8.0 (27ad18e) github.com
- Rails security release announcement rubyonrails.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:07.
Original description (NVD)
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionController::Live::Buffer#close pushes its end-of-stream marker onto the response's bounded queue while it holds the buffer's monitor. When the client has stopped reading and the queue is full, the push blocks, and Buffer#abort, which runs when the client disconnects or a write times out, waits indefinitely for the same monitor. Each such response could permanently hold a web server thread and its ActionController::Live thread, possibly resulting in a DoS vulnerability through thread exhaustion. Applications that stream responses with ActionController::Live, including send_stream, are affected. Applications that serve large files through Active Storage proxy mode are exposed to unauthenticated clients. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
NVD references (5)
- https://github.com/rails/rails/commit/27ad18ed5900dee28ba20e9c6fc718ff751fa215
- https://github.com/rails/rails/commit/ccbfc09690fef05fdd2a9969c917a71b92cc98fc
- https://github.com/rails/rails/releases/tag/v8.0.5.2
- https://github.com/rails/rails/releases/tag/v8.1.4.1
- https://github.com/rails/rails/security/advisories/GHSA-rwvh-fw6r-pwvp
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.