Rails 2.3.x Release Notes

Security Fixes

Action Pack

• CVE-2026-126076 - Fix possible restoration of destroyed sessions in MemCacheStore. A session deleted during a request is no longer written back at the end of it, and a request with an unknown session ID gets a new ID instead of recreating the session. Rack 1.4.7.33 applies the same fix to the bundled Rack::Session::Memcache.

Security Fixes

• CVE-2026-41316 - Fix for ERB vulnerability when using Marshal.load.

Active Record

• CVE-2022-44566 – Resolve incomplete denial-of-service (DoS) fix from earlier release.

Security Fixes

Action View

• CVE-2026-33168 — Fix possible XSS in tag helper.

Active Support

• CVE-2026-33176 — Fix possible DoS vulnerability in number helpers.
• CVE-2026-33169 — Fix possible ReDoS vulnerability in number_to_delimited.

Security Fixes

Active Record

• CVE-2025-55193 - Call inspect on ids in RecordNotFound error.

Active Storage

• CVE-2025-24293 - Remove dangerous transformations.

Notes

• This is the initial release of Never-Ending Support (NES) for Rails v2.3.x.

Security Fixes

Action Mailer

• CVE-2024-47889 – Avoid regex backtracking in block_format helper.

Action Pack

• CVE-2023-28362 – Raise an exception if illegal characters are provide to redirect_to.
• CVE-2021-22885 – Fixed an information disclosure and unintended method execution vulnerability in Action Pack.
• CVE-2020-8159 - Arbitrary file write/potential remote code execution attack.
• CVE-2016-0751 – Fixed a denial-of-service (DoS) vulnerability caused by a crafted HTTP Accept header.

Active Record

• CVE-2022-44566– Fixed a denial-of-service (DoS) vulnerability in Active Record's PostgreSQL adapter.
• CVE-2022-32224 – Fixed a remote code execution (RCE) vulnerability with serialized columns in Active Record.
• CVE-2014-3482 – Fixed a SQL injection vulnerability in Active Record.

Active Resource

• CVE-2020-8151 – Fixed an information disclosure issue in Active Resource.

Active Support

• CVE-2015-3227 - Fixed Active Support vulnerable to Denial of Service via large XML document depth