---
id: "GHSA-rwvh-fw6r-pwvp"
page: "https://infrastack.ai/live/GHSA-rwvh-fw6r-pwvp"
kind: "vulnerability"
aliases: ["GHSA-rwvh-fw6r-pwvp"]
title: "Possible DoS vulnerability in Action Controller Live streaming"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "actionpack", "fixed": ["8.1.4.1"], "affected": ">= 8.1, < 8.1.4.1", "ecosystem": "rubygems"}, {"name": "actionpack", "fixed": ["8.0.5.2"], "affected": "< 8.0.5.2", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["actionpack", "cwe-833", "package", "rails", "ruby", "self-hosted"]
not_affected_if: ["no-active-storage-proxy", "no-live-streaming"]
published_at: "2026-11-04T03:02:11+00:00"
first_seen_at: "2026-11-09T22:53:29+00:00"
updated_at: "2026-11-09T22:55:11+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/rails/rails/security/advisories/GHSA-rwvh-fw6r-pwvp", "first_seen_at": "2026-11-09T22:53:29+00:00"}]
exploit_sources: []
---

# Possible DoS vulnerability in Action Controller Live streaming

Link for people: https://infrastack.ai/live/GHSA-rwvh-fw6r-pwvp (this .md is for agents)

ActionController::Live can block a server thread when a client stops reading a streamed response and the buffer queue is full, because the close path waits on a lock that the disconnect path also needs. Each stuck response can hold a web server thread and its Live thread indefinitely, which can exhaust threads and cause denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:actionpack affected >= 8.1, < 8.1.4.1 fixed 8.1.4.1
- rubygems:actionpack affected < 8.0.5.2 fixed 8.0.5.2

## How to check

- Run `bin/rails -v` or check the `actionpack` version in `Gemfile.lock`, and compare it with the fixed versions.
- Search the app for `ActionController::Live`, `send_stream`, and Active Storage proxy mode, since these are the affected streaming paths.

## Fix

- actionpack `8.1.4.1` for the 8.1 line
- actionpack `8.0.5.2` for the 8.0 line
- Maintainer patches exist for those who cannot upgrade at once: commit ccbfc09690fef05fdd2a9969c917a71b92cc98fc (8.1) and 27ad18ed5900dee28ba20e9c6fc718ff751fa215 (8.0).

## Timeline

- 2026-11-09T22:53:29+00:00 ghsa-repo https://github.com/rails/rails/security/advisories/GHSA-rwvh-fw6r-pwvp

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/rails/rails/security/advisories/GHSA-rwvh-fw6r-pwvp

## From the sources

### Impact
`ActionController::Live::Buffer#close` pushes its end-of-stream marker onto the response's bounded queue while it holds the buffer's monitor. When the client has stopped reading and the queue is full, the push blocks, and `Buffer#abort`, which runs when the client disconnects or a write times out, waits indefinitely for the same monitor. Each such response could permanently hold a web server thread and its `ActionController::Live` thread, possibly resulting in a DoS vulnerability through thread exhaustion.

Applications that stream responses with `ActionController::Live`, including `send_stream`, are affected. Applications that serve large files through Active Storage proxy mode are exposed to unauthenticated clients.

### Releases
The fixed releases are available at the normal locations.

Patches for those who cannot upgrade at once:
- 8.1: https://github.com/rails/rails/commit/ccbfc09690fef05fdd2a9969c917a71b92cc98fc.patch
- 8.0: https://github.com/rails/rails/commit/27ad18ed5900dee28ba20e9c6fc718ff751fa215.patch

### Credit
This issue was found by the Anthropic OSS Scanner (ANT-2026-LDFW5N2T).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_