What’s Vulnerable › Vulnerabilities
CVE-2021-22902
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.9% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2021-06-11 · updated 2026-06-17
- Weakness: CWE-400
Description
The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.
Affected products
- Ruby on Rails: from 6.0.0 before 6.0.3.7; from 6.1.0 before 6.1.0.2 — fixed in 6.0.3.7, 6.1.0.2
How to fix
Upgrade to a fixed version: Ruby on Rails 6.0.3.7, 6.1.0.2. Check the vendor advisory for mitigations.
References
- https://discuss.rubyonrails.org/t/cve-2021-22902-possible-denial-of-service-vulnerability-in-action-dispatch/77866
- https://hackerone.com/reports/1138654
- https://discuss.rubyonrails.org/t/cve-2021-22902-possible-denial-of-service-vulnerability-in-action-dispatch/77866
- https://hackerone.com/reports/1138654
Get alerted when CVE-2021-22902 or the next vulnerability affects your stack