CVE-2026-126072: Thread Deadlock and Denial of Service in Ruby on Rails ActionController::Live

Vulnerability ID: CVE-2026-126072
CVSS Score: 5.9
Published: 2026-11-12

CVE-2026-126072 (GHSA-rwvh-fw6r-pwvp) is a concurrency deadlock vulnerability in the Ruby on Rails Action Pack framework affecting applications that utilize ActionController::Live response streaming. The defect occurs due to improper synchronization within ActionController::Live::Buffer when handling full bounded queues during stream closure and connection abortion. An unauthenticated remote attacker can trigger this condition by stalling TCP socket reads on streaming endpoints—including Active Storage proxy mode—resulting in permanent worker thread exhaustion and application-wide denial of service.

TL;DR

A resource lock-contention deadlock (CWE-833) in Ruby on Rails' ActionController::Live::Buffer allows unauthenticated remote attackers to permanently hang web server worker threads and controller producer threads by ceasing TCP reads on streaming endpoints. Upgrade to Rails 8.1.4.1 or 8.0.5.2.

Technical Details

  • Vulnerability Type: CWE-833: Deadlock
  • Attack Vector: Network (HTTP/HTTPS Streaming)
  • CVSS v3.1 Score: 5.9 Medium (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
  • EPSS Score: 0.41% (35.91st Percentile)
  • Impact: Permanent Worker Thread Exhaustion / Denial of Service
  • Affected Component: ActionController::Live::Buffer (actionpack)
  • Patched Versions: Rails 8.1.4.1, Rails 8.0.5.2
  • CISA KEV Status: Not Listed

Affected Systems

  • Ruby on Rails (rails)
  • Action Pack (actionpack)
  • Action Pack / Ruby on Rails: < 8.0.5.2 (Fixed in: 8.0.5.2)
  • Action Pack / Ruby on Rails: >= 8.1, < 8.1.4.1 (Fixed in: 8.1.4.1)

Code Analysis

Commit: ccbfc09

Replace blocking @buf.push(nil) with non-blocking @buf.close in ActionController::Live::Buffer (v8.1.4.1)

File: actionpack/lib/action_controller/metal/live.rb @@ -218,7 +218,11 @@ def write(string) @response.delete_header "Content-Length" end - super + begin + super + rescue ClosedQueueError + raise IOError, "closed stream" if connected? + end unless connected? @buf.clear @@ -236,14 +240,14 @@ def writeln(string) write string.end_with?("\n") ? string : "#{string}\n" end - # Write a 'close' event to the buffer; the producer/writing thread uses this to - # notify us that it's finished supplying content. + # Close the buffer; the producer/writing thread uses this to notify us that + # it's finished supplying content. # # See also #abort. def close synchronize do super - @buf.push nil + @buf.close @cv.broadcast end end @@ -255,7 +259,9 @@ def close def abort synchronize do @aborted = true + @buf.close @buf.clear + @cv.broadcast end end

Commit: 27ad18e

Backport ActionController::Live::Buffer deadlock fix to 8.0 release branch (v8.0.5.2)

Mitigation Strategies

  • Upgrade Ruby on Rails and Action Pack to patched versions (8.1.4.1 or 8.0.5.2).
  • Switch Active Storage delivery from proxy mode (:rails_storage_proxy) to redirect mode (:rails_storage_redirect) to offload streaming from Rails worker threads.
  • Enable response buffering on upstream reverse proxies (e.g., NGINX proxy_buffering on) to absorb streamed responses and isolate Rails from slow-reading TCP clients.
  • Enforce process-level worker timeouts in Puma cluster mode to automatically kill and respawn deadlocked worker processes.

Remediation Steps:

  1. Identify all applications using ActionController::Live, send_stream, or Active Storage proxy routes.
  2. Update the Gemfile to specify rails '>= 8.1.4.1' (for 8.1.x) or rails '>= 8.0.5.2' (for 8.0.x).
  3. Run 'bundle update rails actionpack' and verify Gemfile.lock reflects the patched version.
  4. Redeploy the application and restart all web server worker processes.

References

Read the full report for CVE-2026-126072 on our website for more details including interactive diagrams and full exploit analysis.