Is CVE-2026-126080 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126080 being exploited in the wild.

How severe is CVE-2026-126080?

High severity, with a CVSS score of 7.5, published 10 November 2026.

Which products and versions are affected?

Rails Active Support before 8.1.4.1 and before 8.0.5.2; activesupport (RubyGems) >= 8.1.0.beta1, < 8.1.4.1, ECOSYSTEM:introduced=8.1.0.beta1,fixed=8.1.4.1.

Is there a fix for CVE-2026-126080?

Yes. activesupport (RubyGems): upgrade to 8.1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126080 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126080?

Check whether you run Rails Active Support or activesupport (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126080: Rails Active Support regular expression injection in safe_constantize

Q: Is there a fix for CVE-2026-126080?

Yes. activesupport (RubyGems): upgrade to 8.1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-126080 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-126080?

Check whether you run Rails Active Support or activesupport (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126080 · Severity: high · CVSS 7.5 · Published 2026-11-10

Active Support is a library of utilities used by Rails web applications. The safe_constantize function builds an unescaped regular expression from user input, allowing an attacker to craft a malicious constant name that causes the server's regex engine to crash. An unauthenticated attacker can exploit this through Action Cable subscriptions, causing denial of service via repeated requests.

Technologies: activesupport (RubyGems). Vendors: Rails, RubyGems.

Quick answers

Is CVE-2026-126080 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126080 being exploited in the wild.
How severe is CVE-2026-126080?: High severity, with a CVSS score of 7.5, published 10 November 2026.
Which products and versions are affected?: Rails Active Support before 8.1.4.1 and before 8.0.5.2; activesupport (RubyGems) >= 8.1.0.beta1, < 8.1.4.1, ECOSYSTEM:introduced=8.1.0.beta1,fixed=8.1.4.1.
Is there a fix for CVE-2026-126080?: Yes. activesupport (RubyGems): upgrade to 8.1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126080 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126080?: Check whether you run Rails Active Support or activesupport (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

activesupport (RubyGems): upgrade to 8.1.4.1 or later
```
bundle update activesupport
```

Technical details

A regular expression is constructed from the constant name parameter without escaping, allowing an attacker to inject regex metacharacters. When LoadError is raised during constant lookup, the unescaped pattern is compiled, and crafted patterns can trigger defects in Ruby's regex compiler. Action Cable invokes safe_constantize on the channel value before authentication, making this remotely exploitable by unauthenticated clients.

Affected products

Rails Active Support before 8.1.4.1 and before 8.0.5.2

Identifiers

CVE-2026-126080
GHSA-8474-xrp6-wh69

Timeline

2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.