Is CVE-2026-126072 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126072 being exploited in the wild.

How severe is CVE-2026-126072?

Medium severity, with a CVSS score of 5.9, published 10 November 2026.

Which products and versions are affected?

Rails Action Pack prior to 8.1.4.1 and 8.0.5.2; actionpack (RubyGems) >= 8.1.0.beta1, < 8.1.4.1.

Is there a fix for CVE-2026-126072?

Yes: fixed in Action Pack 8.1.4.1, 8.0.5.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126072 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126072?

Check whether you run Rails Action Pack or actionpack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126072: Rails Action Pack thread exhaustion in ActionController::Live

Q: Is there a fix for CVE-2026-126072?

Yes: fixed in Action Pack 8.1.4.1, 8.0.5.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-126072 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-126072?

Check whether you run Rails Action Pack or actionpack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126072 · Severity: medium · CVSS 5.9 · Published 2026-11-10

Action Pack is a web framework component that handles HTTP requests and responses in Ruby on Rails. A flaw in its ActionController::Live streaming feature allows attackers to exhaust server threads by causing them to block indefinitely when streaming responses to disconnected clients. This can lead to denial of service, making the web application unresponsive to legitimate users.

Technologies: Rails Action Pack, actionpack (RubyGems). Vendors: Rails, RubyGems.

Quick answers

Is CVE-2026-126072 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126072 being exploited in the wild.
How severe is CVE-2026-126072?: Medium severity, with a CVSS score of 5.9, published 10 November 2026.
Which products and versions are affected?: Rails Action Pack prior to 8.1.4.1 and 8.0.5.2; actionpack (RubyGems) >= 8.1.0.beta1, < 8.1.4.1.
Is there a fix for CVE-2026-126072?: Yes: fixed in Action Pack 8.1.4.1, 8.0.5.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126072 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126072?: Check whether you run Rails Action Pack or actionpack (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Action Pack 8.1.4.1, 8.0.5.2

Technical details

A deadlock condition exists in ActionController::Live::Buffer#close where it holds a monitor lock while pushing to a bounded queue; when the queue is full and a client has disconnected, Buffer#abort waits indefinitely for the same monitor, causing both the web server thread and ActionController::Live thread to hang. This affects streaming responses (send_stream) and Active Storage proxy mode, both of which can be triggered by unauthenticated clients in the case of file serving.

Affected products

Rails Action Pack prior to 8.1.4.1 and 8.0.5.2

Identifiers

CVE-2026-126072
GHSA-rwvh-fw6r-pwvp

Timeline

2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.