CVE-2024-28103: Action Pack is missing security headers on non-HTML responses

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-04 · updated 2026-06-17
Weakness: CWE-20

Description

Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.

Affected products

Ruby on Rails: from 6.1.0 before 6.1.7.8; from 7.0.0 before 7.0.8.4; from 7.1.0 before 7.1.3.4; 7.2.0-beta1 — fixed in 6.1.7.8, 7.0.8.4, 7.1.3.4

How to fix

Upgrade to a fixed version: Ruby on Rails 6.1.7.8, 7.0.8.4, 7.1.3.4. Check the vendor advisory for mitigations.

References

https://github.com/rails/rails/commit/35858f1d9d57f6c4050a8d9ab754bd5d088b4523
https://github.com/rails/rails/security/advisories/GHSA-fwhr-88qx-h9g7
https://github.com/rails/rails/commit/35858f1d9d57f6c4050a8d9ab754bd5d088b4523
https://github.com/rails/rails/security/advisories/GHSA-fwhr-88qx-h9g7
https://security.netapp.com/advisory/ntap-20241206-0002/

Get alerted when CVE-2024-28103 or the next vulnerability affects your stack