Medium severity6.1NVD Advisory· Published Jun 11, 2021· Updated Jun 17, 2026
CVE-2021-22903
CVE-2021-22903
Description
The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881. Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, config.hosts << "sub.example.com" to permit a request with a Host header value of sub-example.com.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
actionpackRubyGems | >= 6.1.0.rc2, < 6.1.3.2 | 6.1.3.2 |
Affected products
4cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*range: >=6.1.1,<6.1.3.2
- cpe:2.3:a:rubyonrails:rails:6.1.0:rc2:*:*:*:*:*:*
- actionpack/actionpack ruby gemdescription
Patches
Vulnerability mechanics
References
7- discuss.rubyonrails.org/t/cve-2021-22903-possible-open-redirect-vulnerability-in-action-pack/77867nvdMitigationPatchVendor AdvisoryWEB
- github.com/advisories/GHSA-5hq2-xf89-9jxqghsaADVISORY
- hackerone.com/reports/1148025nvdPermissions RequiredThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2021-22903ghsaADVISORY
- github.com/rails/rails/releases/tag/v6.1.3.2ghsaWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22903.ymlghsaWEB
- groups.google.com/g/rubyonrails-security/c/8TxqXEtgSF0ghsaWEB
News mentions
0No linked articles in our index yet.