CVE-2026-126080

{
  "etk_id": "ETK-2026-3507",
  "cve_id": "CVE-2026-126080",
  "display_id": "CVE-2026-126080",
  "ghsa_id": "GHSA-8474-xrp6-wh69",
  "euvd_id": "EUVD-2026-122930",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Regular expression injection in ActiveSupport safe_constantize",
  "summary": "Affected ActiveSupport releases construct a regular expression from untrusted constant-name input during failed constant resolution. An attacker may crash the server and cause availability disruption when an application exposes an unauthenticated Action Cable endpoint or otherwise passes untrusted input to safe_constantize.",
  "mitigation": "Upgrade ActiveSupport 8.0 to 8.0.5.2 or later, or 8.1 to 8.1.4.1 or later. Until upgraded, remove unused Action Cable endpoints and require authentication for Action Cable connections.",
  "vendor": "rubygems",
  "product": "rubygems:activesupport",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 8.1.0.beta1, < 8.1.4.1"
      ],
      "ecosystem": "rubygems",
      "fixed_versions": [
        "8.1.4.1"
      ],
      "package_name": "activesupport",
      "purl": "pkg:gem/activesupport"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 8.0.5.2"
      ],
      "ecosystem": "rubygems",
      "fixed_versions": [
        "8.0.5.2"
      ],
      "package_name": "activesupport",
      "purl": "pkg:gem/activesupport"
    }
  ],
  "cwes": [
    74
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 28.765501466666667,
  "t0_at": "2026-11-10T21:04:44.528000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-04T03:02:04+00:00",
      "days": -6.751857962962963,
      "is_lower_bound": false,
      "measured_at": "2026-11-10T21:04:44.528000+00:00",
      "url": "https://github.com/rails/rails/security/advisories/GHSA-8474-xrp6-wh69"
    }
  }
}