CVE-2021-22902

Vulnerability

The actionpack Ruby gem, used for handling and responding to web requests in Rails, contains a denial of service vulnerability in the MIME type parser of Action Dispatch. Versions 6.0.0 up to (but not including) 6.0.3.7, and 6.1.0 up to (but not including) 6.1.3.2 are affected; versions prior to 6.0.0 are not affected [1][3]. The bug resides in the regular expression used to parse HTTP Accept headers, where carefully crafted input triggers catastrophic backtracking in the regex engine [3][4].

Exploitation

An attacker needs only network access to send HTTP requests to an affected Rails application. No authentication or other privileges are required. By crafting a malicious Accept header that exploits the backtracking behavior of the MIME parser’s regular expression, the attacker can cause the regex engine to consume excessive CPU time, potentially stalling request processing [3][4].

Impact

Successful exploitation results in a denial of service (DoS) condition: the application may become unresponsive due to CPU exhaustion, degrading or denying service to legitimate users. No data integrity or confidentiality is directly compromised, and no code execution is achieved [1][3]. The impact is limited to application availability.

Mitigation

Fixed versions are 6.0.3.7 and 6.1.3.2, released on 2021-06-11 and available via the normal Rails distribution channels [2][3][4]. For users unable to upgrade immediately, a monkey patch initializer is provided that modifies the MIME regex to avoid catastrophic backtracking [3][4]. The patch is also available in git-am format for the 6.0 and 6.1 release series. Only the 6.1.Z, 6.0.Z, and 5.2.Z series are currently supported; users of earlier unsupported releases should upgrade promptly [4].