Read the docs
TI-2019-03829 Aliases CVE-2019-5419GHSA-m63j-wh5w-c252

Uncontrolled resource consumption in Rails https://github.com/rails/rails

Priority MEDIUM 44CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.

Why it matters now

EPSS 0.0844 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed actionview (RubyGems): 4.2.11.1, 5.2.2.1, 5.1.6.2 +2Red Hat: 4 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Railshttps://github.com/rails/rails5.2.2.1; 5.1.6.2; 5.0.7.2; 4.2.11.1—No fix listedCNA
—actionview (RubyGems)4.0.0 to before 4.2.11.14.2.11.1Patch availableGHSA-m63j-wh5w-c252
—actionview (RubyGems)5.2.0 to before 5.2.2.15.2.2.1Patch availableGHSA-m63j-wh5w-c252
—actionview (RubyGems)5.1.0 to before 5.1.6.25.1.6.2Patch availableGHSA-m63j-wh5w-c252
—actionview (RubyGems)5.0.0 to before 5.0.7.25.0.7.2Patch availableGHSA-m63j-wh5w-c252
—actionview (RubyGems)6.0.0.beta1 to before 6.0.0.beta36.0.0.beta3Patch availableGHSA-m63j-wh5w-c252
  • https://github.com/rails/rails VendorRails Affected 5.2.2.1; 5.1.6.2; 5.0.7.2; 4.2.11.1 Fixed in — No fix listed CNA
  • actionview (RubyGems) Vendor— Affected 4.0.0 to before 4.2.11.1 Fixed in 4.2.11.1 Patch available GHSA-m63j-wh5w-c252
  • actionview (RubyGems) Vendor— Affected 5.2.0 to before 5.2.2.1 Fixed in 5.2.2.1 Patch available GHSA-m63j-wh5w-c252
  • actionview (RubyGems) Vendor— Affected 5.1.0 to before 5.1.6.2 Fixed in 5.1.6.2 Patch available GHSA-m63j-wh5w-c252
  • actionview (RubyGems) Vendor— Affected 5.0.0 to before 5.0.7.2 Fixed in 5.0.7.2 Patch available GHSA-m63j-wh5w-c252
  • actionview (RubyGems) Vendor— Affected 6.0.0.beta1 to before 6.0.0.beta3 Fixed in 6.0.0.beta3 Patch available GHSA-m63j-wh5w-c252

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*before 4.2.11.1; 5.0.0 to before 5.0.7.2; 5.1.0 to before 5.1.6.2; 5.2.0 to before 5.2.2.1VulnerableRails
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:*4.6VulnerableRed Hat
cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:*4.7VulnerableRed Hat
cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*15.0VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
  • cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* Versions before 4.2.11.1; 5.0.0 to before 5.0.7.2; 5.1.0 to before 5.1.6.2; 5.2.0 to before 5.2.2.1 Vulnerable ·Rails
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:* Versions 4.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:* Versions 4.7 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject

Remediation

  • Fix · GHSA-m63j-wh5w-c252 actionview (RubyGems) Fixed in 4.2.11.1 Advisory →
  • Fix · GHSA-m63j-wh5w-c252 actionview (RubyGems) Fixed in 5.2.2.1 Advisory →
  • Fix · GHSA-m63j-wh5w-c252 actionview (RubyGems) Fixed in 5.1.6.2 Advisory →
  • Fix · GHSA-m63j-wh5w-c252 actionview (RubyGems) Fixed in 5.0.7.2 Advisory →
  • Fix · GHSA-m63j-wh5w-c252 actionview (RubyGems) Fixed in 6.0.0.beta3 Advisory →

Red Hat 4 advisories

  • RHSA-2019:1289 Released 2019-05-29 · Red Hat rating Important
    CloudForms 4.6.9 security, bug fix and enhancement update
    • CloudForms Management Engine 5.9 cfme-5.9.9.3-1.el7cf, cfme-amazon-smartstate-5.9.9.3-1.el7cf, cfme-appliance-5.9.9.3-1.el7cf +3
  • RHSA-2019:1149 Released 2019-05-13 · Red Hat rating Important
    rh-ror42-rubygem-actionpack security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-ror42-rubygem-actionpack-1:4.2.6-5.el6, rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ror42-rubygem-actionpack-1:4.2.6-5.el7, rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-ror42-rubygem-actionpack-1:4.2.6-5.el7, rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-ror42-rubygem-actionpack-1:4.2.6-5.el7, rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-ror42-rubygem-actionpack-1:4.2.6-5.el7, rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-ror42-rubygem-actionpack-1:4.2.6-5.el6, rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ror42-rubygem-actionpack-1:4.2.6-5.el7, rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7
  • RHSA-2019:1147 Released 2019-05-13 · Red Hat rating Important
    rh-ror50-rubygem-actionpack security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-ror50-rubygem-actionpack-1:5.0.1-2.el6, rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ror50-rubygem-actionpack-1:5.0.1-2.el7, rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-ror50-rubygem-actionpack-1:5.0.1-2.el7, rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-ror50-rubygem-actionpack-1:5.0.1-2.el7, rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-ror50-rubygem-actionpack-1:5.0.1-2.el7, rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-ror50-rubygem-actionpack-1:5.0.1-2.el6, rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ror50-rubygem-actionpack-1:5.0.1-2.el7, rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7
Show 1 more Red Hat advisories
  • RHSA-2019:0796 Released 2019-04-23 · Red Hat rating Important
    CloudForms 4.7.3 security, bug fix and enhancement update
    • CloudForms Management Engine 5.10 ansible-tower-3.4.3-1.el7at, ansible-tower-server-3.4.3-1.el7at, ansible-tower-setup-3.4.3-1.el7at +9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Rails https://github.com/rails/rails — FEDORA-2019-1cfe24db5c

    3 records Highest priority Priority CRITICAL 2 CRITICAL, 1 MEDIUM

    Other records, highest priority first

    • TI-2019-03828 Path traversal in Rails https://github.com/rails/railsPriority CRITICAL 90
    • TI-2019-03830 Command injection in Rails https://github.com/rails/railsPriority CRITICAL 85
    Show all 3 records → Advisory →
  • Advisory ·

    Rails https://github.com/rails/rails — openSUSE-SU-2019:1344

    2 records Highest priority Priority CRITICAL 1 CRITICAL, 1 MEDIUM

    Other records, highest priority first

    • TI-2019-03828 Path traversal in Rails https://github.com/rails/railsPriority CRITICAL 90
    Show all 2 records → Advisory →
Show 4 more groups
  • Advisory ·

    Rails https://github.com/rails/rails — RHSA-2019:0796

    2 records Highest priority Priority CRITICAL 1 CRITICAL, 1 MEDIUM

    Other records, highest priority first

    • TI-2019-03828 Path traversal in Rails https://github.com/rails/railsPriority CRITICAL 90
    Show all 2 records → Advisory →
  • Advisory ·

    Rails https://github.com/rails/rails — RHSA-2019:1147

    2 records Highest priority Priority CRITICAL 1 CRITICAL, 1 MEDIUM

    Other records, highest priority first

    • TI-2019-03828 Path traversal in Rails https://github.com/rails/railsPriority CRITICAL 90
    Show all 2 records → Advisory →
  • Advisory ·

    Rails https://github.com/rails/rails — RHSA-2019:1149

    2 records Highest priority Priority CRITICAL 1 CRITICAL, 1 MEDIUM

    Other records, highest priority first

    • TI-2019-03828 Path traversal in Rails https://github.com/rails/railsPriority CRITICAL 90
    Show all 2 records → Advisory →
  • Advisory ·

    Rails https://github.com/rails/rails — RHSA-2019:1289

    2 records Highest priority Priority CRITICAL 1 CRITICAL, 1 MEDIUM

    Other records, highest priority first

    • TI-2019-03828 Path traversal in Rails https://github.com/rails/railsPriority CRITICAL 90
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
CloudForms Management Engine 5.10Fixed RHSA-2019:0796
CloudForms Management Engine 5.9Fixed RHSA-2019:1289
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2019:1147, RHSA-2019:1149
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:1147, RHSA-2019:1149
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)Fixed RHSA-2019:1147, RHSA-2019:1149
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)Fixed RHSA-2019:1147, RHSA-2019:1149
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2019:1147, RHSA-2019:1149
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2019:1147, RHSA-2019:1149
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:1147, RHSA-2019:1149

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-5419
  2. 2026-10-03 Alias added: GHSA-m63j-wh5w-c252

References

Exploit 1

Patch 1

Advisory 10

Other 8

  • TI-2014-00124 Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the… KEVCVSS 3.1HIGH 7.5
  • TI-2019-03828 Path traversal in Rails https://github.com/rails/rails KEVCVSS 3.1HIGH 7.5
  • TI-2016-00672 Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x… KEVCVSS 3.1HIGH 7.5
  • TI-2019-03830 Command injection in Rails https://github.com/rails/rails CVSS 3.1CRITICAL 9.8
  • TI-2020-06581 Code injection in https://github.com/rails/rails CVSS 3.1HIGH 8.8
  • TI-2013-00091 active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before… CVSS 2.0HIGH 7.5
See all 117 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences