-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| actionpack | rubygems | >= 7.0.0, < 7.0.4.1 | 7.0.4.1 |
| actionpack | rubygems | < 6.1.7.1 | 6.1.7.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how Action Dispatch parses the If-None-Match header using an inefficient regex. The patch filenames ('Avoid-regex-backtracking-on-If-None-Match-header') and CWE-1333 classification indicate the root cause was in regex handling for ETag parsing. The #etags method in Cache::Request is responsible for splitting ETag values from the header, and prior to the patch, used a regex vulnerable to catastrophic backtracking (e.g., patterns like /"[^"]*"/ without proper anchors or atomic grouping). Ruby versions <3.2.0's regex engine exacerbated this issue. The high confidence comes from the direct correlation between the vulnerability description, CWE classification, and the patched component's responsibility for header parsing.
RubyRubyOngoing coverage of React2Shell