CVE-2021-22880
Active Record subject to Regular Expression Denial-of-Service (ReDoS)
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the money type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the money type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
- Record
CVE-2021-22880- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400
- Updated
- 2026-11-02
CVE List No score
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the money type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
- Record
CVE-2021-22880- Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2021-0633 No score
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the money type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
- Record
EUVD-2021-0633- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8hc4-xxm3-5ppp
Active Record subject to Regular Expression Denial-of-Service (ReDoS)
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the money type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
- Record
GHSA-8hc4-xxm3-5ppp- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the money type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
- Record
CVE-2021-22880- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-22880
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the money type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
- Record
DEBIAN-CVE-2021-22880- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSVGHSA-8hc4-xxm3-5ppp
Active Record subject to Regular Expression Denial-of-Service (ReDoS)
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the money type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
- Record
GHSA-8hc4-xxm3-5ppp- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-22880
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the money type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.
- Record
UBUNTU-CVE-2021-22880- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1468-1 No score
Security update for rubygem-activerecord-5_1
This update for rubygem-activerecord-5_1 fixes the following issues:
- CVE-2021-22880: Fixed possible DoS vector in PostgreSQL money type (bsc#1182169).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2021:1468-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:3634-1 No score
Security update for rubygem-activerecord-5_1
This update for rubygem-activerecord-5_1 fixes the following issues:
- CVE-2021-22880: Fixed possible DoS vector in PostgreSQL money type (bsc#1182169).
- Record
openSUSE-SU-2021:3634-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11326-1 No score
ruby2.7-rubygem-activerecord-5.2-5.2.6-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-activerecord-5.2-5.2.6-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11326-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11327-1 No score
ruby2.7-rubygem-activerecord-6.0-6.0.4-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-activerecord-6.0-6.0.4-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11327-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11826-1 No score
ruby3.1-rubygem-activerecord-6.0-6.0.4.4-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-activerecord-6.0-6.0.4.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11826-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3267-1 No score
Security update for rubygem-activerecord-4_2
This update for rubygem-activerecord-4_2 fixes the following issues:
- CVE-2021-22880: Fixed possible DoS vector in PostgreSQL money type (bsc#1182169).
- Record
SUSE-SU-2021:3267-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3634-1 No score
Security update for rubygem-activerecord-5_1
This update for rubygem-activerecord-5_1 fixes the following issues:
- CVE-2021-22880: Fixed possible DoS vector in PostgreSQL money type (bsc#1182169).
- Record
SUSE-SU-2021:3634-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activerecordRubyGems |
5.0.0 to 5.2.4.4 | 5.2.4.5 |
activerecordRubyGems |
6.0.0 to 6.0.3.4 | 6.0.3.5 |
activerecordRubyGems |
6.1.0 to 6.1.2.0 | 6.1.2.1 |
railsDebian:12 |
before 2:6.0.3.5+dfsg-1 | 2:6.0.3.5+dfsg-1 |
railsDebian:13 |
before 2:6.0.3.5+dfsg-1 | 2:6.0.3.5+dfsg-1 |
railsDebian:14 |
before 2:6.0.3.5+dfsg-1 | 2:6.0.3.5+dfsg-1 |
railsDebian:10 From an advisory covering 3 CVEs |
before 2:5.2.2.1+dfsg-1+deb10u3, plus listed versions 2:5.2.2.1+dfsg-12:5.2.2.1+dfsg-1+deb10u12:5.2.2.1+dfsg-1+deb10u2 |
2:5.2.2.1+dfsg-1+deb10u3 |
activerecordRubyGems |
5.0.0 up to 5.2.4.5, plus listed versions 5.0.0.15.0.15.0.1.rc15.0.1.rc25.0.2 Show 45 moreShow less5.0.2.rc15.0.35.0.45.0.4.rc15.0.55.0.5.rc15.0.5.rc25.0.65.0.6.rc15.0.75.0.7.15.0.7.25.1.05.1.0.beta15.1.0.rc15.1.0.rc25.1.15.1.25.1.2.rc15.1.35.1.3.rc15.1.3.rc25.1.3.rc35.1.45.1.4.rc15.1.55.1.5.rc15.1.65.1.6.15.1.6.25.1.75.1.7.rc15.2.05.2.0.beta15.2.0.beta25.2.0.rc15.2.0.rc25.2.15.2.1.15.2.1.rc15.2.25.2.2.15.2.2.rc15.2.35.2.3.rc1 |
5.2.4.5 |
activerecordRubyGems |
6.0.0 up to 6.0.3.5, plus listed versions 6.0.16.0.1.rc16.0.26.0.2.16.0.2.2 Show 8 moreShow less6.0.2.rc16.0.2.rc26.0.36.0.3.16.0.3.26.0.3.36.0.3.46.0.3.rc1 |
6.0.3.5 |
activerecordRubyGems |
6.1.0 up to 6.1.2.1, plus listed versions 6.1.16.1.2 |
6.1.2.1 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rubygem-activerecord-4_2SUSE:OpenStack Cloud Crowbar 8 |
before 4.2.9-6.6.1 | 4.2.9-6.6.1 |
rubygem-activerecord-4_2SUSE:OpenStack Cloud Crowbar 9 |
before 4.2.9-6.6.1 | 4.2.9-6.6.1 |
rubygem-activerecord-5_1SUSE:Linux Enterprise High Availability Extension 15 |
before 5.1.4-5.3.3 | 5.1.4-5.3.3 |
rubygem-activerecord-5_1SUSE:Linux Enterprise High Availability Extension 15 SP1 |
before 5.1.4-5.3.3 | 5.1.4-5.3.3 |
rubygem-activerecord-5_1SUSE:Linux Enterprise High Availability Extension 15 SP2 |
before 5.1.4-5.3.3 | 5.1.4-5.3.3 |
rubygem-activerecord-5_1SUSE:Linux Enterprise High Availability Extension 15 SP3 |
before 5.1.4-5.3.3 | 5.1.4-5.3.3 |
railsUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:4.1.10-12:4.2.5-12:4.2.5.1-12:4.2.5.2-22:4.2.6-12:4.2.6-1ubuntu0.1~esm12:4.2.6-1ubuntu0.1~esm2 |
None known |
railsUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2:4.2.9-22:4.2.9-42:4.2.10-0ubuntu42:4.2.10-0ubuntu4+esm12:4.2.10-0ubuntu4+esm2 |
None known |
railsUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2:5.2.2.1+dfsg-1ubuntu12:5.2.3+dfsg-32:5.2.3+dfsg-3ubuntu0.1~esm1 |
None known |
railsUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2:6.0.3.7+dfsg-22:6.1.4.1+dfsg-8ubuntu22:6.1.4.1+dfsg-8ubuntu2+esm1 |
None known |
railsUbuntu:24.04:LTS |
All versions, plus listed versions 2:6.1.7.3+dfsg-2build12:6.1.7.3+dfsg-3 |
None known |
railsUbuntu:25.10 |
All versions, plus listed versions 2:6.1.7.3+dfsg-72:7.2.2.1+dfsg-7 |
None known |
railsUbuntu:26.10 |
All versions, plus listed versions 2:7.2.3+dfsg-22:7.2.3.2+dfsg-2 |
None known |
railsUbuntu:26.04:LTS |
All versions, plus listed versions 2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-22:7.2.3+dfsg-2 |
None known |
rubygem-activerecord-5_1openSUSE:Leap 15.2 |
before 5.1.4-lp152.4.3.1 | 5.1.4-lp152.4.3.1 |
rubygem-activerecord-5_1openSUSE:Leap 15.3 |
before 5.1.4-5.3.3 | 5.1.4-5.3.3 |
rubygem-activerecord-6.0openSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 6.0.4.4-1.1 | 6.0.4.4-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | halkichi0308/CVE-2021-22880 | 2023-10-30 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-22880 is a high vulnerability (CVSS 7.5) in Rubyonrails Rails, published February 11, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.49%, the 91st percentile. Fixed in activerecord 5.2.4.5.
References
hackerone.com/reports/1023899
discuss.rubyonrails.org/t/cve-2021-22880-possible-dos-vulnerability-in-active-record-postgresql-adapter/77129
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3
debian.org/security/2021/dsa-4929
security.netapp.com/advisory/ntap-20210805-0009
Show 19 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-22880
github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2021-22880.yml
groups.google.com/g/rubyonrails-security/c/ZzUqCh9vyhI
security-tracker.debian.org/tracker/CVE-2021-22880
suse.com/support/update/announcement/2021/suse-su-20213267-1
bugzilla.suse.com/1182169
ubuntu.com/security/CVE-2021-22880
cve.org/CVERecord?id=CVE-2021-22880
lists.opensuse.org/archives/list/[email protected]/thread/RROJLD5MLZPMJEWUQBDZP3I6WJGCWMUE
Left out here: 6 versions. The JSON record has them.