CVE-2019-5419: There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can…

PriorityP343high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

EPSS

8.67%

94.5th percentile

There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.

Affected

25 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	rails	< rails 2:5.2.2.1+dfsg-1 (bookworm)	rails 2:5.2.2.1+dfsg-1 (bookworm)
fedoraproject	fedora	—	—
opensuse	leap	—	—
opensuse	leap	—	—
rails	actionview	>= 4.0.0 < 4.2.11.1	4.2.11.1
rails	actionview	>= 5.0.0 < 5.0.7.2	5.0.7.2
rails	actionview	>= 5.1.0 < 5.1.6.2	5.1.6.2
rails	actionview	>= 5.2.0 < 5.2.2.1	5.2.2.1
rails	actionview	>= 6.0.0.beta1 < 6.0.0.beta3	6.0.0.beta3
rails	https_github.com_rails_rails	—	—
rails	https_github.com_rails_rails	—	—
rails	https_github.com_rails_rails	—	—
rails	https_github.com_rails_rails	—	—
redhat	cloudforms	—	—
redhat	cloudforms	—	—
redhat	software_collections	—	—
rubyonrails	rails	< 4.2.11.1	4.2.11.1
rubyonrails	rails	>= 0 < 2:5.2.2.1+dfsg-1	2:5.2.2.1+dfsg-1
rubyonrails	rails	>= 0 < 2:5.2.2.1+dfsg-1	2:5.2.2.1+dfsg-1
rubyonrails	rails	>= 0 < 2:5.2.2.1+dfsg-1	2:5.2.2.1+dfsg-1
rubyonrails	rails	>= 0 < 2:5.2.2.1+dfsg-1	2:5.2.2.1+dfsg-1
rubyonrails	rails	>= 5.0.0 < 5.0.7.2	5.0.7.2
rubyonrails	rails	>= 5.1.0 < 5.1.6.2	5.1.6.2
rubyonrails	rails	>= 5.2.0 < 5.2.2.1	5.2.2.1

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C

osv7.5HIGH

vendor_debian7.5HIGH

vendor_redhat7.5HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.