CVE-2021-22880: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 4.4% chance of exploitation in the next 30 days.

The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.

Affected products

• Fedoraproject Fedora: version 32 only; version 33 only
• Rubyonrails Rails: from 4.2.0, before 5.2.4.5 (fixed in 5.2.4.5); from 6.0.0, before 6.0.3.5 (fixed in 6.0.3.5); from 6.1.0, before 6.1.2.1 (fixed in 6.1.2.1)

Published 2021-02-11. Last modified 2026-06-17.