ACTIONPACK · GHSA-rwvh-fw6r-pwvp · Package
FIX → 8.1.4.1 +1
ActionController::Live can block a server thread when a client stops reading a streamed response and the buffer queue is full, because the close path waits on a lock that the disconnect path also needs. Each stuck response can hold a web server thread and its Live thread indefinitely, which can exhaust threads and cause denial of service.
first public Nov 4, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that stream responses with ActionController::Live, including send_stream, are affected. Applications that serve large files through Active Storage proxy mode are exposed to unauthenticated clients. Apps that do not use these streaming features can skip it.
Not affected if no-active-storage-proxy, no-live-streaming
Who cares actionpack, rails, ruby, self-hosted
bin/rails -v or check the actionpack version in Gemfile.lock, and compare it with the fixed versions.ActionController::Live, send_stream, and Active Storage proxy mode, since these are the affected streaming paths.ActionController::Live::Buffer#close pushes its end-of-stream marker onto the response's bounded queue while it holds the buffer's monitor. When the client has stopped reading and the queue is full, the push blocks, and Buffer#abort, which runs when the client disconnects or a write times out, waits indefinitely for the same monitor. Each such response could permanently hold a web server thread and its ActionController::Live thread, possibly resulting in a DoS vulnerability through thread exhaustion.
Applications that stream responses with ActionController::Live, including send_stream, are affected. Applications that serve large files through Active Storage proxy mode are exposed to unauthenticated clients.
The fixed releases are available at the normal locations.
Patches for those who cannot upgrade at once:
This issue was found by the Anthropic OSS Scanner (ANT-2026-LDFW5N2T).
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 8.1.4.1 +1
8.1.4.1 for the 8.1 line8.0.5.2 for the 8.0 line