# CVE-2026-126080: Rails Active Support regular expression injection in safe_constantize

Source: https://junglewise.ai/threats/cve-2026-126080-active-support-is-a-collection-of-utility-classes-and-standard  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-126080 · Severity: high · CVSS 7.5 · Published 2026-11-10

Active Support is a library of utilities used by Rails web applications. The safe_constantize function builds an unescaped regular expression from user input, allowing an attacker to craft a malicious constant name that causes the server's regex engine to crash. An unauthenticated attacker can exploit this through Action Cable subscriptions, causing denial of service via repeated requests.

Technologies: [activesupport (RubyGems)](https://junglewise.ai/threats/technologies/activesupport). Vendors: [Rails](https://junglewise.ai/threats/vendors/rails), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-126080 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-126080 being exploited in the wild.

**How severe is CVE-2026-126080?** High severity, with a CVSS score of 7.5, published 10 November 2026.

**Which products and versions are affected?** Rails Active Support before 8.1.4.1 and before 8.0.5.2; activesupport (RubyGems) >= 8.1.0.beta1, < 8.1.4.1, ECOSYSTEM:introduced=8.1.0.beta1,fixed=8.1.4.1.

**Is there a fix for CVE-2026-126080?** Yes. activesupport (RubyGems): upgrade to 8.1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-126080 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-126080?** Check whether you run Rails Active Support or activesupport (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- activesupport (RubyGems): upgrade to 8.1.4.1 or later

  ```sh
  bundle update activesupport
  ```


## Technical details

A regular expression is constructed from the constant name parameter without escaping, allowing an attacker to inject regex metacharacters. When LoadError is raised during constant lookup, the unescaped pattern is compiled, and crafted patterns can trigger defects in Ruby's regex compiler. Action Cable invokes safe_constantize on the channel value before authentication, making this remotely exploitable by unauthenticated clients.

## Affected products

- Rails Active Support before 8.1.4.1 and before 8.0.5.2

## Identifiers

- CVE-2026-126080
- GHSA-8474-xrp6-wh69

## Timeline

- 2026-11-10: disclosed

## References

- [https://github.com/rails/rails/commit/210ac22d446c8e2625b091e79256806b836eee20](https://github.com/rails/rails/commit/210ac22d446c8e2625b091e79256806b836eee20)
- [https://github.com/rails/rails/commit/95aa9e416016524956d4904fed96eaed079580bb](https://github.com/rails/rails/commit/95aa9e416016524956d4904fed96eaed079580bb)

## Related threats

- [Rails Active Support MessagePack unsafe serialization XSS](https://junglewise.ai/threats/cve-2026-126075-active-support-is-a-collection-of-utility-classes-and-standard)
- [Rails Active Support has a possible DoS vulnerability in its number helpers](https://junglewise.ai/threats/cve-2026-33176-rails-active-support-has-a-possible-dos-vulnerability-in-its)
- [Ruby on Rails Active Support XSS in SafeBuffer](https://junglewise.ai/threats/cve-2026-33170-ruby-on-rails-active-support-xss-in-safebuffer)
- [Rails Active Support has a possible ReDoS vulnerability in number_to_delimited](https://junglewise.ai/threats/cve-2026-33169-rails-active-support-has-a-possible-redos-vulnerability-in-number)
- [Active Support Possibly Discloses Locally Encrypted Files](https://junglewise.ai/threats/cve-2023-38037-active-support-possibly-discloses-locally-encrypted-files)