234 matches found
UBUNTU-CVE-2026-126085
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSServiceurlfordirectupload does not bind the declared content length into the signed direct-upload URL, and...
UBUNTU-CVE-2026-126071
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streamingsendblobstream handles an error from the...
CVE-2026-126071
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streamingsendblobstream handles an error from the...
CVE-2026-126085
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSServiceurlfordirectupload does not bind the declared content length into the signed direct-upload URL, and...
CVE-2026-126071
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streamingsendblobstream handles an error from the...
CVE-2026-126085
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSServiceurlfordirectupload does not bind the declared content length into the signed direct-upload URL, and...
CVE-2026-126085
A flaw was found in Active Storage. A remote attacker can bypass application file size validations and storage quotas when direct uploads to Google Cloud Storage GCS are used. The service fails to bind content length restrictions into signed direct-upload URLs, allowing an attacker to upload file...
Linux Distros Unpatched Vulnerability : CVE-2026-126085
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2,...
DEBIAN-CVE-2026-126085
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSServiceurlfordirectupload does not bind the declared content length into the signed direct-upload URL, and...
CVE-2026-126085
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSServiceurlfordirectupload does not bind the declared content length into the signed direct-upload URL, and...
GHSA-HFR4-8RJC-97M2 Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage
Impact ActiveStorage::Service::GCSServiceurlfordirectupload does not bind the declared content length into the signed direct-upload URL, and headersfordirectupload returns no length constraint, so the URL authorizes an upload body of any size. A direct-upload client could store a file larger than...
Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage
Impact ActiveStorage::Service::GCSServiceurlfordirectupload does not bind the declared content length into the signed direct-upload URL, and headersfordirectupload returns no length constraint, so the URL authorizes an upload body of any size. A direct-upload client could store a file larger than...
CVE-2026-126071
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streamingsendblobstream handles an error from the...
CVE-2026-126085
The Active Storage component in Rails (prior to versions 8.1.4.1 and 8.0.5.2 ) is vulnerable to a circumvention of file size limits during direct uploads to Google Cloud Storage . The root cause is that ActiveStorage::Service::GCSService#url_for_direct_upload fails to bind the declared content le...
CVE-2026-126085
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSServiceurlfordirectupload does not bind the declared content length into the signed direct-upload URL, and...
EUVD-2026-122939
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSServiceurlfordirectupload does not bind the declared content length into the signed direct-upload URL, and...
CVE-2026-126085 Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSServiceurlfordirectupload does not bind the declared content length into the signed direct-upload URL, and...
CVE-2026-126085 Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSServiceurlfordirectupload does not bind the declared content length into the signed direct-upload URL, and...
CVE-2026-126071 Active Storage: Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streamingsendblobstream handles an error from the...
CVE-2026-126071
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streamingsendblobstream handles an error from the...