-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability centers around HTTP Token authentication methods like authenticate_or_request_with_http_token. These methods ultimately call the Token.authenticate and token_and_options methods in http_authentication.rb, which use regex patterns to parse Authorization headers. The advisory's mention of Ruby 3.2's regex mitigations and the CWE-1333 classification strongly suggests a vulnerable regex pattern in these authentication handlers. While exact commit diffs aren't available, the described impact pattern matches the known authentication flow in these files.
RubyRuby| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| actionpack | rubygems | >= 4.0.0, < 6.1.7.9 | 6.1.7.9 |
| actionpack | rubygems | >= 7.0.0, < 7.0.8.5 | 7.0.8.5 |
| actionpack |
| rubygems |
| >= 7.1.0, < 7.1.4.1 |
| 7.1.4.1 |
| actionpack | rubygems | >= 7.2.0, < 7.2.1.1 | 7.2.1.1 |
KEV Misses 88% of Exploited CVEs- Get the report