.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

activesupport 2.2.3 vulnerabilities

17 advisories known · activesupport@2.2.3 · 9 affect this release · Dependencies not checked

SEVERITYADVISORYPUBLISHED

Affects 2.2.3

SEVERITYADVISORYPUBLISHED

MediumRails Active Support has a possible DoS vulnerability in its number helpersGHSA-2j26-frm8-cmj9CVE-2026-33176Affected <7.2.3.1, >=8.0.0.beta1 <8.0.4.1, >=8.1.0.beta1 <8.1.2.1Fixed in 7.2.3.1 Fixed in 8.0.4.1 Fixed in 8.1.2.1OSV source ↗8 months ago

MediumRails Active Support has a possible XSS vulnerability in SafeBuffer#%GHSA-89vf-4333-qx8vCVE-2026-33170Affected <7.2.3.1, >=8.0.0.beta1 <8.0.4.1, >=8.1.0.beta1 <8.1.2.1Fixed in 7.2.3.1 Fixed in 8.0.4.1 Fixed in 8.1.2.1OSV source ↗8 months ago

MediumRails Active Support has a possible ReDoS vulnerability in number_to_delimitedGHSA-cg4j-q9v8-6v38CVE-2026-33169Affected <7.2.3.1, >=8.0.0.beta1 <8.0.4.1, >=8.1.0.beta1 <8.1.2.1Fixed in 7.2.3.1 Fixed in 8.0.4.1 Fixed in 8.1.2.1OSV source ↗8 months ago

Mediumactivesupport Cross-site Scripting vulnerabilityGHSA-9fh3-vh3h-q4g3CVE-2011-2932Affected >=2.0.0 <2.3.13, >=3.0.0 <3.0.10Fixed in 2.3.13 Fixed in 3.0.10OSV source ↗9 years ago

Mediumrails Cross-site Scripting vulnerabilityGHSA-v9v4-7jp6-8c73CVE-2011-2197Affected >=2.0.0 <2.3.12, >=3.0.0 <3.0.8Fixed in 2.3.12 Fixed in 3.0.8OSV source ↗9 years ago

Mediumactivesupport Cross-site Scripting vulnerabilityGHSA-h835-75hw-pj89CVE-2012-3464Affected <2.3.16, >=3.0.0.beta <3.0.17, >=3.1.0 <3.1.8, >=3.2.0 <3.2.8, ==3.0.preFixed in 2.3.16 Fixed in 3.0.17 Fixed in 3.1.8 Fixed in 3.2.8OSV source ↗9 years ago

Mediumactivesupport vulnerable to Denial of Service via large XML document depthGHSA-j96r-xvjq-r9pgCVE-2015-3227Affected <3.2.22, >=4.0.0.beta1 <4.1.11, >=4.2.0.beta1 <4.2.2Fixed in 3.2.22 Fixed in 4.1.11 Fixed in 4.2.2OSV source ↗9 years ago

MediumPossible XSS Security Vulnerability in SafeBuffer#bytespliceGHSA-pj73-v5mw-pm9jCVE-2023-28120Affected <6.1.7.3, >=7.0.0 <7.0.4.3Fixed in 6.1.7.3 Fixed in 7.0.4.3OSV source ↗4 years ago

LowReDoS based DoS vulnerability in Active Support's underscoreGHSA-j6gc-792m-qgm2CVE-2023-22796Affected <6.1.7.1, >=7.0.0 <7.0.4.1Fixed in 6.1.7.1 Fixed in 7.0.4.1OSV source ↗4 years ago

Does not affect 2.2.3

SEVERITYADVISORYPUBLISHED

CriticalActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStoreGHSA-2p68-f74v-9wc6CVE-2020-8165Affected >=5.0.0 <5.2.4.3, >=6.0.0 <6.0.3.1Fixed in 5.2.4.3 Fixed in 6.0.3.1OSV source ↗6 years ago

Highactivesupport in Rails vulnerable to incorrect data conversionGHSA-xgr2-v94m-rc9gCVE-2013-0333Affected >=2.3.2 <2.3.16, >=3.0.0 <3.0.20Fixed in 2.3.16 Fixed in 3.0.20OSV source ↗9 years ago

MediumCross site scripting that affects railsGHSA-8qrh-h9m2-5fvfCVE-2009-3009Affected >=2.0.0 <2.2.3, >=2.3.0 <2.3.4Fixed in 2.2.3 Fixed in 2.3.4OSV source ↗9 years ago

Mediumactionpack and activesupport vulnerable to information leaksGHSA-fg9w-g6m4-557jCVE-2009-3086Affected >=2.1.0 <2.2.3, >=2.3.0 <2.3.4Fixed in 2.2.3 Fixed in 2.3.4OSV source ↗9 years ago

Mediumactivesupport Cross-site Scripting vulnerabilityGHSA-qv8p-v9qw-wc7gCVE-2012-1098Affected >=3.0.0 <3.0.12, >=3.1.0 <3.1.4, >=3.2.0 <3.2.2Fixed in 3.0.12 Fixed in 3.1.4 Fixed in 3.2.2OSV source ↗9 years ago

Mediumactivesupport Improper Input Validation vulnerabilityGHSA-9c2j-593q-3g82CVE-2013-1856Affected >=3.0.0 <3.1.12, >=3.2.0 <3.2.13Fixed in 3.1.12 Fixed in 3.2.13OSV source ↗9 years ago

Mediumactivesupport Cross-site Scripting vulnerabilityGHSA-vxvp-4xwc-jpp6CVE-2015-3226Affected >=4.1.0 <4.1.11, >=4.2.0 <4.2.2Fixed in 4.1.11 Fixed in 4.2.2OSV source ↗9 years ago

MediumActive Support Possibly Discloses Locally Encrypted FilesGHSA-cr5q-6q9f-rq6qCVE-2023-38037Affected >=5.2.0 <6.1.7.5, >=7.0.0 <7.0.7.1Fixed in 6.1.7.5 Fixed in 7.0.7.1OSV source ↗3 years ago