Rails 2.3.x

2.3.18.60

Bug Fixes

• CVE-2025-24293 (activestorage) allowed transformation methods that were potentially unsafe
• CVE-2025-55193 (activestorage) logging vulnerable to ANSI escape injection

Rack 1.4.7.27

Bug Fixes

• Removed an unnecessary warning caused by the last change ("unknown or unsafe x-sendfile variation"). This change has no security implications.

Rack 1.4.7.26

Bug Fixes

• CVE-2025-61919: Rack::Request#POST reads the entire request body into memory for Content-Type:application/x-www-form-urlencoded, calling rack.input.read(nil) without enforcing a length or cap. Large request bodies can therefore be buffered completely into process memory before parsing, leading to denial of service (DoS) through memory exhaustion.
• CVE-2025-61780: A possible information disclosure vulnerability existed in Rack::Sendfile when running behind a proxy that supports x-sendfile headers (such as Nginx). Specially crafted headers could cause Rack::Sendfile to miscommunicate with the proxy and trigger unintended internal requests, potentially bypassing proxy-level access restrictions.

Rack 1.4.7.25

Bug Fixes

• CVE-2025-61770: Rack::Multipart::Parser buffers the entire multipart preamble (bytes before the first boundary) in memory without any size limit. A client can send a large preamble followed by a valid boundary, causing significant memory use and potential process termination due to out-of-memory (OOM) conditions.
• CVE-2025-61771: Rack::Multipart::Parser stores non-file form fields (parts without a filename) entirely in memory as Ruby String objects. A single large text field in a multipart/form-data request (hundreds of megabytes or more) can consume equivalent process memory, potentially leading to out-of-memory (OOM) conditions and denial of service (DoS).
• CVE-2025-61772: Rack::Multipart::Parser can accumulate unbounded data when a multipart part's header block never terminates with the required blank line (CRLFCRLF). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS).

2.3.18.59

Rack 1.4.7.24

• CVE-2025-49007: There is a denial of service vulnerability in the Content-Disposition parsing component of Rack.

Notes

• This is the initial release of the NES Rails 2.3.x series. It also includes the initial release of Rack v1.4.7.23. As well as the below bug fixes.

Bug Fixes

• CVE-2025-46727 (rack) - Unbounded-Parameter DoS in Rack::QueryParser
• CVE-2025-32441 (rack) - Session Reuse in Rack::Session::Pool
• CVE-2025-27111 (rack) - Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection
• CVE-2025-27610 (rack) - Local File Inclusion in Rack::Static
• CVE-2025-25184 (rack) - Possible Log Injection in Rack::CommonLogger
• CVE-2023-28362 (actionpack) – Fixed a possible cross-site scripting (XSS) vulnerability when handling user-supplied values in redirect_to.
• CVE-2016-0751 (actionpack) – Fixed a denial-of-service (DoS) vulnerability caused by a crafted HTTP Accept header.
• CVE-2021-22885 (actionpack) – Fixed an information disclosure and unintended method execution vulnerability in Action Pack.
• CVE-2016-0752 (actionpack) – Directory traversal vulnerability does not apply to version 2.3.18.
• CVE-2022-32224 (activerecord) – Fixed a remote code execution (RCE) vulnerability with serialized columns in Active Record.
• CVE-2022-44566 (activerecord) – Fixed a denial-of-service (DoS) vulnerability in Active Record's PostgreSQL adapter.
• CVE-2014-3482 (activerecord) – Fixed a SQL injection vulnerability in Active Record.
• CVE-2020-8151 (activeresource) – Fixed an information disclosure issue in Active Resource.
• CVE-2024-25126 (rack) – Fixed a Regular Expression Denial-of-Service (ReDoS) vulnerability in content type parsing.
• CVE-2023-27530 (rack) – Fixed a possible DoS vulnerability in Multipart MIME parsing.
• CVE-2020-8161 (rack) – Fixed a directory traversal vulnerability in the Rack::Directory app bundled with Rack.
• CVE-2018-16471 (rack) – Fixed a cross-site scripting (XSS) vulnerability in Rack.
• CVE-2022-30122 (rack) – Fixed a denial-of-service (DoS) vulnerability in Rack Multipart Parsing.
• CVE-2020-8184 (rack) – Fixed an issue where Rack allowed percent-encoded cookies to overwrite existing prefixed cookie names.
• CVE-2022-30123 (rack) – Fixed a possible shell escape sequence injection vulnerability in Rack.
• CVE-2024-26141 (rack) – Fixed a possible DoS vulnerability with the Range Header in Rack.
• CVE-2024-26146 (rack) - Fixed a Rack Header Parsing leads to Possible Denial of Service Vulnerability
• CVE-2015-3227 (activesupport) - Fixed activesupport vulnerable to Denial of Service via large XML document depth
• CVE-2019-16782 (rack) - Fixed a possible Information Leak / Session Hijack Vulnerability in Rack
• CVE-2024-26146 (rack) - Fixed Rack Header Parsing leads to Possible Denial of Service Vulnerability