Rails Active Support: Denial of service in safe_constantize
Summary
Active Support, the utility library used by Rails and other Ruby projects, contains a denial-of-service flaw in safe_constantize. When a constant lookup raises LoadError, the requested constant name is inserted unescaped into a regular expression, so crafted input can trigger defects in Ruby's regex compiler. Action Cable passes the channel value of each subscribe command to this method, so an unauthenticated client can reach it if the application mounts Action Cable and accepts connections from untrusted clients; repeated requests could crash the server process and keep the application unavailable.
Affected
- activesupport 8.1.x from 8.1.0 up to (not including) 8.1.4.1
- activesupport below 8.0.5.2
Fixed in
- activesupport 8.1.4.1
- activesupport 8.0.5.2
Workaround
Unknown. The vendor advisory lists no configuration workaround beyond applying the patch.
Exploitation
- No known exploitation in the wild.
- Public proof of concept: unknown.
Our recommendation
- Inventory Rails and activesupport versions (Gemfile.lock) and upgrade to 8.1.4.1 or 8.0.5.2.
- Check whether Action Cable is mounted and reachable without authentication, and restrict or disable it if it is not needed.
- Plan the upgrade for Rails 8.0, which is nearing end of security support, and migrate older Rails versions, which receive no fix.
- Monitor for server crashes or worker restarts after the update.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-8474-xrp6-wh69 (Rails) github.com
- GitHub Advisory Database GHSA-8474-xrp6-wh69 github.com
- Rails release v8.1.4.1 github.com
- Rails release v8.0.5.2 github.com
- Fix commit 95aa9e4 (8.1 line) github.com
- Fix commit 210ac22 (8.0 line) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:48.
Original description (NVD)
Active Support is a collection of utility classes and standard library extensions used by Rails and other Ruby projects. Prior to 8.1.4.1 and 8.0.5.2, when constant lookup raises LoadError, ActiveSupport::Inflector#safe_constantize (and String#safe_constantize) builds a regular expression from the requested constant name without escaping it, so a caller that passes untrusted input lets the attacker choose the source of a pattern that the application compiles. Crafted patterns can trigger defects in Ruby's regular expression compiler, possibly leading to a crash of the server process, and repeated requests could keep the application unavailable. Action Cable passes the channel value of each subscribe command to safe_constantize before any channel lookup, so an unauthenticated client can reach this code when the application mounts Action Cable and accepts connections from untrusted clients without an added authentication check. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
NVD references (5)
- https://github.com/rails/rails/commit/210ac22d446c8e2625b091e79256806b836eee20
- https://github.com/rails/rails/commit/95aa9e416016524956d4904fed96eaed079580bb
- https://github.com/rails/rails/releases/tag/v8.0.5.2
- https://github.com/rails/rails/releases/tag/v8.1.4.1
- https://github.com/rails/rails/security/advisories/GHSA-8474-xrp6-wh69
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.