Vulnerability advisory

CVE-2019-5419

Published Mar 27, 2019Updated Oct 24, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/rails/rails ↗
All commits before e06a1e09b6bec32b0a05c72a3ae7ceb00f61bf7d	`e06a1e09b6bec32b0a05c72a3ae7ceb00f61bf7d`
2efddadd6cba4e2129acedf1d402d11abcc03996 to before c4d3e202e10ae627b3b9c34498afb45450652421	`c4d3e202e10ae627b3b9c34498afb45450652421`
ce93740a5e4437dfc1cf9b0b13da1bad06a2a598 to before ec8697bf0bfafff7d897fb50e322afe42ddc1623	`ec8697bf0bfafff7d897fb50e322afe42ddc1623`
375a4143cf5caeb6159b338be824903edfd62836 to before e69ff43060c1194d2a3bd9b8d9e23f3ae26b84b5	`e69ff43060c1194d2a3bd9b8d9e23f3ae26b84b5`
Also listed as affected (63) `v4.2.11` `v5.0.7.1` `v5.1.6.1` `v5.2.2` `v5.2.2.rc1` `v5.0.7` `v5.1.6` `v5.2.1.rc1` `v5.2.0.rc1` `v4.2.10` `v4.2.10.rc1` `v5.1.4.rc1` `v5.0.5` `v5.0.5.rc2` `v5.1.3.rc1` `v5.0.5.rc1` `v5.1.2.rc1` `v5.0.4.rc1` `v4.2.9.rc1` `v5.0.3` `v5.1.1` `v5.1.0` `v5.1.0.beta1` `v4.2.7.rc1` `v5.0.0.rc2` `v5.0.0.rc1` `v5.0.0.beta4` `v5.0.0.beta2` `v5.0.0.beta1` `v4.2.5.rc1` `v4.2.4.rc1` `v4.2.0.rc1` `v4.2.0.beta1` `v4.0.0.rc1` `v4.0.0.beta1` `v3.2.0.rc1` `v3.1.0.rc1` `v3.1.0.beta1` `v3.0.0.beta3` `v3.0.0.beta.3` `v2.0.1` `v2.0.0` `v2.0.0_RC2` `v2.0.0_RC1` `v2.0.0_PR` `v1.1.1` `v1.1.0` `v1.1.0_RC1` `v0.14.3` `v0.14.1` `v0.13.1` `v0.13.0` `v0.12.0` `v0.11.1` `v0.11.0` `v0.10.1` `v0.10.0` `v0.9.5` `v0.9.4.1` `v0.9.4` `v0.9.3` `v0.9.2` `v0.9.1`

Description

There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.

CVE-2019-5419

Affected versions

Repository

Description

References