{"action":"Upgrade actionpack to 5.2.4.6 or later.","affected":[{"fixed":"6.0.3.7","introduced":"6.0.0"},{"fixed":"6.1.3.2","introduced":"6.1.0"},{"fixed":"5.2.6","introduced":"5.2.5"},{"fixed":"5.2.4.6","introduced":"4.0.0"}],"component":"actionpack","cve_ids":["CVE-2021-22904"],"ecosystem":"RubyGems","epss":0.04868,"exploited":false,"fixed_versions":["6.0.3.7","6.1.3.2","5.2.6","5.2.4.6"],"ghsa_id":"GHSA-7wjx-3g7j-8584","id":"tcs_01M5KEHTWHV9PYM240W90VTVE3","modified_at":"2024-02-16T08:20:03.075990Z","published_at":"2021-05-05T19:49:12Z","references":["https://osv.dev/vulnerability/GHSA-7wjx-3g7j-8584","https://nvd.nist.gov/vuln/detail/CVE-2021-22904","https://hackerone.com/reports/1101125","https://discuss.rubyonrails.org/t/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token-authentication/77869","https://github.com/rails/rails","https://github.com/rails/rails/releases/tag/v5.2.4.6","https://github.com/rails/rails/releases/tag/v5.2.6","https://github.com/rails/rails/releases/tag/v6.0.3.7","https://github.com/rails/rails/releases/tag/v6.1.3.2","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22904.yml","https://groups.google.com/g/rubyonrails-security/c/Pf1TjkOBdyQ","https://security.netapp.com/advisory/ntap-20210805-0009"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-7wjx-3g7j-8584","url":"https://osv.dev/vulnerability/GHSA-7wjx-3g7j-8584"}],"summary":"Possible DoS Vulnerability in Action Controller Token Authentication"}