CVE-2026-126072

Action Pack versions prior to 8.1.4.1 and 8.0.5.2 are vulnerable to a Denial of Service (DoS) via thread exhaustion. The issue resides in ActionController::Live::Buffer#close , which pushes an end-of-stream marker onto a bounded queue while holding the buffer's monitor. If a client stops reading ...

CVE-2026-126071

The Active Storage component in versions 8.0 until 8.0.5.2 and 8.1.4.1 is vulnerable to a Denial of Service (DoS) condition. The root cause is located in ActiveStorage::Streaming#send_blob_stream , which fails to properly close an ActionController::Live buffer when a storage service error occurs ...

EUVD-2026-122995

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streamingsendblobstream handles an error from the...

PT-2026-144726

Name of the Vulnerable Software and Affected Versions Active Storage versions 8.0 through 8.0.5.1 Active Storage versions 8.1 through 8.1.4.0 Description When serving files through proxy controllers, the ActiveStorage::Streamingsend blob stream function handles storage service errors by calling...