CVE-2021-22904CWE-400

The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in…

published June 11, 2021

CVSS
—
EPSS
5%
Percentile
92.0
In the wild
Unconfirmed
What it is

The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04868 · 92.0th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2021-06-11T15:49Z
EPSS history
Timeline
  • 11 JUN 15:49Z
    The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in…
    cvelistv5