Hoch 7.5Linux-Server
CVE-2026-126080
activesupport: Active Support: Denial of Service via unescaped regular expressions in safe_constantize
activesupport
### Impact When constant lookup raises `LoadError`, `ActiveSupport::Inflector#safe_constantize` (and `String#safe_constantize`) builds a regular expression from the requested constant name without escaping it, so a caller that passes untrusted input lets the attacker choose the source of a pattern that the application compiles. Crafted patterns can trigger defects in Ruby's regular expression compiler, possibly leading to a crash of the server process, and repeated requests…
10. Nov 2026
Original bei Red Hat öffnen