Vulnetix
Try Vulnetix Request Demo
CVE-2021-22880 PUBLISHED

The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.

EPSS 2.46% · 85.1th percentile

Risk Scores

EPSS Score
2.46%
85.1th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:20.04:LTSrails2:5.2.3+dfsg-3ubuntu0.1~esm1, 2:5.2.3+dfsg-3, 2:5.2.2.1+dfsg-1ubuntu1
Ubuntu:24.04:LTSrails2:6.1.7.3+dfsg-3, 2:6.1.7.3+dfsg-2build1, 0
Ubuntu:Pro:16.04:LTSrails*, 2:4.1.10-1, 2:4.2.5.1-1
Ubuntu:Pro:18.04:LTSrails2:4.2.9-4, *, 2:4.2.10-0ubuntu4+esm2
Ubuntu:25.10rails2:7.2.2.1+dfsg-7, 0, 2:6.1.7.3+dfsg-7
Ubuntu:Pro:22.04:LTSrails2:6.1.4.1+dfsg-8ubuntu2, 0, *

Timeline

References

Open in Interactive Console →