VDB

CVE-2021-22904

CVE-2021-22904 PUBLISHED

The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.

EPSS 3.34% · 87.5th percentile

Risk Scores

EPSS Score
3.34%
87.5th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:20.04:LTSrails0, 2:5.2.2.1+dfsg-1ubuntu1, 2:5.2.3+dfsg-3
Ubuntu:24.04:LTSrails2:6.1.7.3+dfsg-3, 0, 2:6.1.7.3+dfsg-2build1
Ubuntu:25.10rails0, 2:7.2.2.1+dfsg-7, 2:6.1.7.3+dfsg-7
Ubuntu:Pro:22.04:LTSrails2:6.1.4.1+dfsg-8ubuntu2+esm1, 0, 2:6.1.4.1+dfsg-8ubuntu2
Ubuntu:Pro:18.04:LTSrails2:4.2.10-0ubuntu4+esm1, 2:4.2.10-0ubuntu4+esm2, *
Ubuntu:Pro:16.04:LTSrails2:4.2.6-1, 2:4.2.6-1ubuntu0.1~esm2, 2:4.2.6-1ubuntu0.1~esm1

Exploit Intelligence

…and 97 more exploits

Timeline

  • May 5, 2021 CVE Published
  • Jun 12, 2021 EPSS Score
  • Jan 6, 2022 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • Mar 7, 2023 EPSS Score
  • Nov 21, 2024 CVE Updated
  • Mar 17, 2025 EPSS Score
  • Mar 21, 2025 EPSS Score
  • Mar 22, 2025 EPSS Score
  • Mar 23, 2025 EPSS Score
  • Mar 26, 2025 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›