CVE-2021-22904

The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-06-11 16:15

Updated : 2024-02-28 18:28


NVD link : CVE-2021-22904

Mitre link : CVE-2021-22904

CVE.ORG link : CVE-2021-22904


JSON object : View

Products Affected

rubyonrails

  • rails
CWE
NVD-CWE-Other CWE-400

Uncontrolled Resource Consumption