CVE-2021-22880

HIGH

Active Record <6.1.2.1, 6.0.3.5, 5.2.4.5 - DoS

Title source: llm

Description

The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.

Exploits (1)

nomisec SUSPICIOUS 1 stars
by halkichi0308 · poc
https://github.com/halkichi0308/CVE-2021-22880

Scores

CVSS v3 7.5
EPSS 0.0260
EPSS Percentile 85.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-400
Status published
Products (4)
fedoraproject/fedora 32
fedoraproject/fedora 33
rubygems/activerecord 5.0.0 - 5.2.4.5RubyGems
rubyonrails/rails 4.2.0 - 5.2.4.5
Published Feb 11, 2021
Tracked Since Feb 18, 2026