CVE-2021-22902

    Dashboard / Vulnerabilities / CVE-2021-22902

    CVE-2021-22902

    Published: 11 Jun 2021Last Modified: 9 Sept 2026

    Summary:

    Details: The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.

    References: https://hackerone.com/reports/1138654, https://discuss.rubyonrails.org/t/cve-2021-22902-possible-denial-of-service-vulnerability-in-action-dispatch/77866

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 66cabeda2c46c582d19738e1318be8d59584cc5b
    Fixed -c04aff675d4cd3e8a54e0008dbfca10a8832a414

    Affected versions

    v6.0.3.6
    v6.0.3.5
    v6.0.3.4
    v6.0.3.3
    v6.0.3.2
    v6.0.3.1
    v6.0.3
    v6.0.3.rc1
    v6.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-22902 | CVE-DB