CVE-2021-22904

The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.

• CWE-400

• https://discuss.rubyonrails.org/t/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token-authentication/77869Exploit, Mitigation, Patch, Vendor Advisory
• https://hackerone.com/reports/1101125Permissions Required, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210805-0009/Third Party Advisory
• https://discuss.rubyonrails.org/t/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token-authentication/77869Exploit, Mitigation, Patch, Vendor Advisory
• https://hackerone.com/reports/1101125Permissions Required, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210805-0009/Third Party Advisory

Published

Jun 11, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-22899A command injection vulnerability exists in Pulse Connect Se…8.8
• CVE-2021-2290Vulnerability in the Oracle Engineering product of Oracle E-…8.1
• CVE-2021-22900A vulnerability allowed multiple unrestricted uploads in Pul…7.2
• CVE-2021-22901curl 7.75.0 through 7.76.1 suffers from a use-after-free vul…8.1
• CVE-2021-22902The actionpack ruby gem (a framework for handling and respon…7.5
• CVE-2021-22903The actionpack ruby gem before 6.1.3.2 suffers from a possib…6.1
• CVE-2021-22905Nextcloud Android App (com.nextcloud.client) before v3.16.0 …6.5
• CVE-2021-22906Nextcloud End-to-End Encryption before 1.5.3, 1.6.3 and 1.7.…6.5
• CVE-2021-22907An improper access control vulnerability exists in Citrix Wo…7.8
• CVE-2021-22908A buffer overflow vulnerability exists in Windows File Resou…8.8
• CVE-2021-22909A vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earli…7.5
• CVE-2021-2291Vulnerability in the Oracle VM VirtualBox product of Oracle …4.7