Mittel 5.3Linux-Server
CVE-2026-126071
activestorage: Active Storage: Denial of Service via thread exhaustion from streaming storage errors
activestorage
### Impact When Active Storage serves a file through its proxy controllers, `ActiveStorage::Streaming#send_blob_stream` handles an error from the storage service by calling `head` to send a 404 or 500 response. If the error occurs after the first chunk has been written, the response is already committed, and `head` replaces the response body while the server is still reading the original `ActionController::Live` buffer. That buffer is never closed, so the server thread…
10. Nov 2026
Original bei Red Hat öffnen