2026-11
“Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming”github.com ›
“Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage”github.com ›
“Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing”github.com ›
“Regular Expression Denial of Service in Addressable templates with several exploded variables”github.com ›
“Addressable display_uri can show misleading hosts containing bidi and invisible characters”github.com ›
“Addressable URI normalization resolves some dotted path segments to the wrong path”github.com ›
“Regular Expression Denial of Service in Addressable templates with multiple variables”github.com ›
“Regular Expression Denial of Service in Addressable templates with certain exploded expressions”github.com ›
“Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url”osv.dev ›
“Faraday has a possible incomplete fix for GHSA-33mh-2634-fwr2: protocol-relative URI objects still bypass host scoping”osv.dev ›
“Faraday: Uncontrolled recursion in NestedParamsEncoder allows stack exhaustion DoS via deeply nested query parameters”osv.dev ›
“Possible Mutation XSS when serializing noscript content in Nokogiri::HTML5 documents”github.com ›
“Possible regular expression denial of service with certain configurations of rails-html-sanitizer”github.com ›
2026-10
“ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore”osv.dev ›
“Concurrent Ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruption”osv.dev ›
“Concurrent Ruby : AtomicReference#update livelocks when the stored value is Float::NAN”osv.dev ›
“Concurrent Ruby: ReentrantReadWriteLock read-count overflow grants a write lock without exclusivity”osv.dev ›
“Rack::Request#host_with_port and #base_url return an invalid Host verbatim, enabling URL and allowlist bypass”github.com ›
“Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.”github.com ›
“Multipart boundary guard skips a leading empty or quoted boundary parameter, allowing parser differentials and WAF bypass”github.com ›
“Rack::Static header_rules bypass via unnormalized dot segments in the request path”github.com ›
“sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity”osv.dev ›
“AGL is no longer available in the macOS SDK. AGL was previously used to present OpenGL content in Carbon apps, and Carbon no longer exists in the SDK. AGL symbols now do nothing on 64-bit systems, including Intel x86_64 and Apple Silicon Macs. It is safe to remove any AGL usage and stop linking AGL. OpenGL still remains in the SDK. (153913819)”developer.apple.com ›
“Algorithms DES, 3DES, SHA1-96 and SHA1-160 as well as Diffie-Hellman groups less than 14 are no longer supported for IKEv2 VPNs. (148767790)”developer.apple.com ›
“This release removes support for the following deprecated NSPersistentStore option keys: NSPersistentStoreUbiquitousContentNameKey NSPersistentStoreUbiquitousContentURLKey NSPersistentStoreUbiquitousPeerTokenOption NSPersistentStoreRemoveUbiquitousMetadataOption NSPersistentStoreUbiquitousContainerIdentifierKey NSPersistentStoreRebuildFromUbiquitousContentOption These keys have been deprecated for…”developer.apple.com ›