{"id":"GHSA-rwvh-fw6r-pwvp","kind":"vulnerability","aliases":["GHSA-rwvh-fw6r-pwvp"],"related":[],"title":"Possible DoS vulnerability in Action Controller Live streaming","description":"### Impact\n`ActionController::Live::Buffer#close` pushes its end-of-stream marker onto the response's bounded queue while it holds the buffer's monitor. When the client has stopped reading and the queue is full, the push blocks, and `Buffer#abort`, which runs when the client disconnects or a write times out, waits indefinitely for the same monitor. Each such response could permanently hold a web server thread and its `ActionController::Live` thread, possibly resulting in a DoS vulnerability through thread exhaustion.\n\nApplications that stream responses with `ActionController::Live`, including `send_stream`, are affected. Applications that serve large files through Active Storage proxy mode are exposed to unauthenticated clients.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/ccbfc09690fef05fdd2a9969c917a71b92cc98fc.patch\n- 8.0: https://github.com/rails/rails/commit/27ad18ed5900dee28ba20e9c6fc718ff751fa215.patch\n\n### Credit\nThis issue was found by the Anthropic OSS Scanner (ANT-2026-LDFW5N2T).","summary":"ActionController::Live can block a server thread when a client stops reading a streamed response and the buffer queue is full, because the close path waits on a lock that the disconnect path also needs. Each stuck response can hold a web server thread and its Live thread indefinitely, which can exhaust threads and cause denial of service.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"actionpack","fixed":["8.1.4.1"],"affected":">= 8.1, < 8.1.4.1","ecosystem":"rubygems"},{"name":"actionpack","fixed":["8.0.5.2"],"affected":"< 8.0.5.2","ecosystem":"rubygems"}],"ecosystems":["rubygems"],"tags":["actionpack","cwe-833","package","rails","ruby","self-hosted"],"not_affected_if":["no-active-storage-proxy","no-live-streaming"],"how_to_check":"- Run `bin/rails -v` or check the `actionpack` version in `Gemfile.lock`, and compare it with the fixed versions.\n- Search the app for `ActionController::Live`, `send_stream`, and Active Storage proxy mode, since these are the affected streaming paths.","fix":"- actionpack `8.1.4.1` for the 8.1 line\n- actionpack `8.0.5.2` for the 8.0 line\n- Maintainer patches exist for those who cannot upgrade at once: commit ccbfc09690fef05fdd2a9969c917a71b92cc98fc (8.1) and 27ad18ed5900dee28ba20e9c6fc718ff751fa215 (8.0).","status":"open","published_at":"2026-11-04T03:02:11+00:00","first_seen_at":"2026-11-09T22:53:29+00:00","triaged_at":"2026-11-09T22:55:11+00:00","updated_at":"2026-11-09T22:55:11+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-09T22:55:11Z","model":"claude-haiku-5-5","output":{"fix":"- actionpack `8.1.4.1` for the 8.1 line\n- actionpack `8.0.5.2` for the 8.0 line\n- Maintainer patches exist for those who cannot upgrade at once: commit ccbfc09690fef05fdd2a9969c917a71b92cc98fc (8.1) and 27ad18ed5900dee28ba20e9c6fc718ff751fa215 (8.0).","reach":"internet","title":"Rails Action Controller Live: stalled client can exhaust server threads","impact":"medium","summary":"ActionController::Live can block a server thread when a client stops reading a streamed response and the buffer queue is full, because the close path waits on a lock that the disconnect path also needs. Each stuck response can hold a web server thread and its Live thread indefinitely, which can exhaust threads and cause denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["rails","actionpack","ruby","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Server threads held indefinitely, causing denial of service through thread exhaustion","analyst_note":"","how_to_check":"- Run `bin/rails -v` or check the `actionpack` version in `Gemfile.lock`, and compare it with the fixed versions.\n- Search the app for `ActionController::Live`, `send_stream`, and Active Storage proxy mode, since these are the affected streaming paths.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-live-streaming","no-active-storage-proxy"],"who_is_affected":"Applications that stream responses with ActionController::Live, including send_stream, are affected. Applications that serve large files through Active Storage proxy mode are exposed to unauthenticated clients. Apps that do not use these streaming features can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000845,"input_tokens":4986,"output_tokens":692,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':235C '-833':23B '/rails/rails/commit/27ad18ed5900dee28ba20e9c6fc718ff751fa215.patch':223C '/rails/rails/commit/ccbfc09690fef05fdd2a9969c917a71b92cc98fc.patch':219C '8.0':220C '8.1':216C 'abort':129C 'action':5A 'actioncontrol':30B,89C,159C,176C 'actionpack':19A,20A,21B 'activ':189C 'affect':182C 'also':63B 'ant':234C 'anthrop':231C 'applic':171C,183C 'avail':203C 'block':33B,126C 'bound':104C 'buffer':47B,91C,110C,128C 'cannot':212C 'caus':84B 'client':39B,115C,134C,197C 'close':53B,92C 'control':6A 'could':150C 'credit':224C 'cwe':22B 'denial':85B 'disconnect':61B,135C 'dos':2A,166C 'end':96C 'end-of-stream':95C 'exhaust':81B,170C 'expos':194C 'file':187C 'fix':200C 'found':228C 'full':50B,123C 'fw6r':12A,17A 'ghsa':10A,15A 'ghsa-rwvh-fw6r-pwvp':9A,14A 'github.com':218C,222C 'github.com/rails/rails/commit/27ad18ed5900dee28ba20e9c6fc718ff751fa215.patch':221C 'github.com/rails/rails/commit/ccbfc09690fef05fdd2a9969c917a71b92cc98fc.patch':217C 'hold':69B,108C,152C 'host':29B 'impact':88C 'includ':178C 'indefinit':78B,142C 'issu':226C 'larg':186C 'ldfw5n2t':236C 'live':7A,31B,76B,90C,160C,177C 'locat':207C 'lock':58B 'marker':99C 'mode':192C 'monitor':112C,146C 'need':64B 'normal':206C 'onto':100C 'oss':232C 'packag':24B 'patch':208C 'path':54B,62B 'perman':151C 'possibl':1A,162C 'proxi':191C 'push':93C,125C 'pwvp':13A,18A 'queue':48B,105C,121C 'rail':25B 'read':41B,118C 'releas':198C,201C 'respons':44B,67B,102C,149C,174C 'result':163C 'rubi':26B 'run':131C 'rwvh':11A,16A 'scanner':233C 'self':28B 'self-host':27B 'send':179C 'serv':185C 'server':35B,72B,155C 'servic':87B 'stop':40B,117C 'storag':190C 'stream':8A,43B,98C,173C,180C 'stuck':66B 'thread':36B,73B,77B,82B,156C,161C,169C 'time':139C 'unauthent':196C 'upgrad':213C 'vulner':3A,167C 'wait':55B,141C 'web':71B,154C 'write':138C","nicknames":[],"mitigations":[],"who_affected":"Applications that stream responses with ActionController::Live, including send_stream, are affected. Applications that serve large files through Active Storage proxy mode are exposed to unauthenticated clients. Apps that do not use these streaming features can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["actionpack"],"ptokens":["actionpack"],"labels":["actionpack","cwe833","medium","package","rails","ruby","rubygems","selfhosted"],"campaign_type":null,"search_a":"'action':5A 'actionpack':19A,20A 'control':6A 'dos':2A 'fw6r':12A,17A 'ghsa':10A,15A 'ghsa-rwvh-fw6r-pwvp':9A,14A 'live':7A 'possibl':1A 'pwvp':13A,18A 'rwvh':11A,16A 'stream':8A 'vulner':3A","search_b":"'-833':23B 'actioncontrol':30B 'actionpack':21B 'also':63B 'block':33B 'buffer':47B 'caus':84B 'client':39B 'close':53B 'cwe':22B 'denial':85B 'disconnect':61B 'exhaust':81B 'full':50B 'hold':69B 'host':29B 'indefinit':78B 'live':31B,76B 'lock':58B 'need':64B 'packag':24B 'path':54B,62B 'queue':48B 'rail':25B 'read':41B 'respons':44B,67B 'rubi':26B 'self':28B 'self-host':27B 'server':35B,72B 'servic':87B 'stop':40B 'stream':43B 'stuck':66B 'thread':36B,73B,77B,82B 'wait':55B 'web':71B","search_c":"'-2026':235C '/rails/rails/commit/27ad18ed5900dee28ba20e9c6fc718ff751fa215.patch':223C '/rails/rails/commit/ccbfc09690fef05fdd2a9969c917a71b92cc98fc.patch':219C '8.0':220C '8.1':216C 'abort':129C 'actioncontrol':89C,159C,176C 'activ':189C 'affect':182C 'ant':234C 'anthrop':231C 'applic':171C,183C 'avail':203C 'block':126C 'bound':104C 'buffer':91C,110C,128C 'cannot':212C 'client':115C,134C,197C 'close':92C 'could':150C 'credit':224C 'disconnect':135C 'dos':166C 'end':96C 'end-of-stream':95C 'exhaust':170C 'expos':194C 'file':187C 'fix':200C 'found':228C 'full':123C 'github.com':218C,222C 'github.com/rails/rails/commit/27ad18ed5900dee28ba20e9c6fc718ff751fa215.patch':221C 'github.com/rails/rails/commit/ccbfc09690fef05fdd2a9969c917a71b92cc98fc.patch':217C 'hold':108C,152C 'impact':88C 'includ':178C 'indefinit':142C 'issu':226C 'larg':186C 'ldfw5n2t':236C 'live':90C,160C,177C 'locat':207C 'marker':99C 'mode':192C 'monitor':112C,146C 'normal':206C 'onto':100C 'oss':232C 'patch':208C 'perman':151C 'possibl':162C 'proxi':191C 'push':93C,125C 'queue':105C,121C 'read':118C 'releas':198C,201C 'respons':102C,149C,174C 'result':163C 'run':131C 'scanner':233C 'send':179C 'serv':185C 'server':155C 'stop':117C 'storag':190C 'stream':98C,173C,180C 'thread':156C,161C,169C 'time':139C 'unauthent':196C 'upgrad':213C 'vulner':167C 'wait':141C 'web':154C 'write':138C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-04T03:02:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-rwvh-fw6r-pwvp","url":"https://github.com/rails/rails/security/advisories/GHSA-rwvh-fw6r-pwvp","severity":"medium","published_at":"2026-11-04T03:02:11+00:00","modified_at":"2026-11-04T03:02:11+00:00","first_seen_at":"2026-11-09T22:53:29+00:00","fetched_at":"2026-11-09T22:53:29+00:00","note":null}],"documents":[{"id":110668,"url":"https://github.com/rails/rails/security/advisories/GHSA-rwvh-fw6r-pwvp","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}