CVE-2021-22904: Rubyonrails Rails

High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days.

The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.

Affected products

• Rubyonrails Rails: before 5.2.4.6 (fixed in 5.2.4.6); from 5.2.5, before 5.2.6 (fixed in 5.2.6); from 6.0.0, before 6.0.3.7 (fixed in 6.0.3.7); from 6.1.0, before 6.1.3.2 (fixed in 6.1.3.2)

Published 2021-06-11. Last modified 2026-06-17.