---
id: "GHSA-8474-xrp6-wh69"
page: "https://infrastack.ai/live/GHSA-8474-xrp6-wh69"
kind: "vulnerability"
aliases: ["GHSA-8474-xrp6-wh69"]
title: "Possible DoS vulnerability in Active Support safe_constantize"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "activesupport", "fixed": ["8.1.4.1"], "affected": ">= 8.1, < 8.1.4.1", "ecosystem": "rubygems"}, {"name": "activesupport", "fixed": ["8.0.5.2"], "affected": "< 8.0.5.2", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["action-cable", "activesupport", "cwe-74", "package", "rails", "ruby"]
not_affected_if: ["auth-required", "no-action-cable", "untrusted-input-never-reaches-safe-constantize"]
published_at: "2026-11-04T03:02:04+00:00"
first_seen_at: "2026-11-09T22:53:29+00:00"
updated_at: "2026-11-09T22:54:20+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/rails/rails/security/advisories/GHSA-8474-xrp6-wh69", "first_seen_at": "2026-11-09T22:53:29+00:00"}]
exploit_sources: []
---

# Possible DoS vulnerability in Active Support safe_constantize

Link for people: https://infrastack.ai/live/GHSA-8474-xrp6-wh69 (this .md is for agents)

ActiveSupport's safe_constantize builds a regular expression from an unescaped constant name, so untrusted input can supply a crafted pattern. Crafted patterns can crash the server process, and repeated requests can keep the application unavailable.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:activesupport affected >= 8.1, < 8.1.4.1 fixed 8.1.4.1
- rubygems:activesupport affected < 8.0.5.2 fixed 8.0.5.2

## How to check

- Check the installed version with `bundle exec gem list activesupport` and compare it to the fixed versions.
- Look for Action Cable mounted at `/cable` (`config.action_cable.mount_path`) and for `subscribe` commands reaching `safe_constantize`.
- Check whether `ApplicationCable::Connection#connect` rejects unauthenticated clients.

## Fix

- activesupport `8.1.4.1` for the 8.1 line
- activesupport `8.0.5.2` for the 8.0 line

## Timeline

- 2026-11-09T22:53:29+00:00 ghsa-repo https://github.com/rails/rails/security/advisories/GHSA-8474-xrp6-wh69

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/rails/rails/security/advisories/GHSA-8474-xrp6-wh69

## From the sources

### Impact
When constant lookup raises `LoadError`, `ActiveSupport::Inflector#safe_constantize` (and `String#safe_constantize`) builds a regular expression from the requested constant name without escaping it, so a caller that passes untrusted input lets the attacker choose the source of a pattern that the application compiles. Crafted patterns can trigger defects in Ruby's regular expression compiler, possibly leading to a crash of the server process, and repeated requests could keep the application unavailable.

Action Cable passes the `channel` value of each `subscribe` command to `safe_constantize` before any channel lookup, so in the default configuration an unauthenticated client of the Action Cable endpoint can reach this code.

### Details
The check that decides whether `safe_constantize` returns `nil` or re-raises the `LoadError` now matches the first segment of the constant name against the error message as a literal string, and no longer compiles a regular expression. It returns the same result as before for constant names that contain no regular expression syntax.

### Affected applications
An application is affected if it meets all of these requirements:
- Mounts Action Cable, which a new Rails application does by default at `/cable` (`config.action_cable.mount_path`), or otherwise passes untrusted input to `safe_constantize`.
- Accepts Action Cable connections from untrusted clients. `ApplicationCable::Connection#connect` authenticates nobody unless the application adds a check.

### Workarounds
Applications that do not use Action Cable can set `config.action_cable.mount_path = nil` to remove the endpoint. Applications that use Action Cable can call `reject_unauthorized_connection` in `ApplicationCable::Connection#connect` for unauthenticated clients, which limits exposure to authenticated users but does not remove it.

### Releases
The fixed releases are available at the normal locations.

Patches for those who cannot upgrade at once:
- 8.1: https://github.com/rails/rails/commit/95aa9e416016524956d4904fed96eaed079580bb.patch
- 8.0: https://github.com/rails/rails/commit/210ac22d446c8e2625b091e79256806b836eee20.patch

### Versions affected

- activesupport < 8.0.5.2
- activesupport >= 8.1, < 8.1.4.1

### Credit
This issue was responsibly reported by Felix Tscheulin ([flixt](https://hackerone.com/flixt)) through HackerOne researcher [scheja](https://hackerone.com/scheja), and independently by Bucky Wolfe ([Igneous](https://github.com/Igneous)), who provided a proof of concept that crashes the server. It was also found by the Anthropic OSS Scanner (ANT-2026-ZUN5KU3Q).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_