{"id":"EM-20261110-SDF1","url":"https://cyber.eventmonitor.net/incident/EM-20261110-SDF1/activestorage-vulnerability-cve-2026-126071/","type":"cve","title":"activestorage Vulnerability (CVE-2026-126071)","subtitle":"CVE-2026-126071","subject":"CVE-2026-126071","status":"Developing","severity":"medium","affected":[],"headline":null,"born":"2026-11-10T21:24:31.000Z","firstSignal":"2026-11-10T20:40:37.000Z","lastSignal":"2026-11-10T21:24:31.000Z","updated":"2026-11-11T12:38:43.721Z","revision":1,"life":[{"status":"Born","at":"2026-11-10T21:24:31.000Z","why":"second independent source: C26 GitHub Advisory Database"},{"status":"Developing","at":"2026-11-10T21:24:31.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-10T20:40:37.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-10T21:24:31.000Z","what":"Born: second source, C26 GitHub Advisory Database. Page EM-20261110-SDF1 created."}],"stages":[{"name":"Disclosed","at":"2026-11-10T21:19:25.263Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-10T21:19:25.263Z","detail":"CVSS 5.3"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-10T20:40:37.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-10T20:40:37.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":2,"title":"Red Hat: CVE-2026-126071 (moderate)","text":"activestorage: Active Storage: Denial of Service via thread exhaustion from streaming storage errors","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-126071.json"},{"at":"2026-11-10T21:24:31.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":2,"title":"GHSA-4v2w-w6g6-f8f8 / CVE-2026-126071: Active Storage: Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming","text":"rubygems:activestorage, rubygems:activestorage","url":"https://github.com/advisories/GHSA-4v2w-w6g6-f8f8"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-10T21:19:25.263","score":5.3,"severity":"MEDIUM","desc":"Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. From 8.0 until 8.0.5.2 and 8.1.4.1, when Active Storage serves a file through its proxy controllers, ActiveStorage::Streaming#send_blob_stream handles an error from the…","product":"","seen":1794353084878},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}