CVE-2021-22881
Actionpack Open Redirect Vulnerability
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
- Record
CVE-2021-22881- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
CVE List No score
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
- Record
CVE-2021-22881- Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2021-0631 No score
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
- Record
EUVD-2021-0631- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8877-prq4-9xfw
Actionpack Open Redirect Vulnerability
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
- Record
GHSA-8877-prq4-9xfw- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
- Record
CVE-2021-22881- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-22881
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
- Record
DEBIAN-CVE-2021-22881- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-8877-prq4-9xfw
Actionpack Open Redirect Vulnerability
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
- Record
GHSA-8877-prq4-9xfw- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-22881
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
- Record
UBUNTU-CVE-2021-22881- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11318-1 No score
ruby2.7-rubygem-actionpack-6.0-6.0.4-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-actionpack-6.0-6.0.4-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11318-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11821-1 No score
ruby3.1-rubygem-actionpack-6.0-6.0.4.4-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-actionpack-6.0-6.0.4.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11821-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
actionpackRubyGems |
6.0.0 to 6.0.3.4 | 6.0.3.5 |
actionpackRubyGems |
6.1.0 to 6.1.2.0 | 6.1.2.1 |
railsDebian:12 |
before 2:6.0.3.5+dfsg-1 | 2:6.0.3.5+dfsg-1 |
railsDebian:13 |
before 2:6.0.3.5+dfsg-1 | 2:6.0.3.5+dfsg-1 |
railsDebian:14 |
before 2:6.0.3.5+dfsg-1 | 2:6.0.3.5+dfsg-1 |
actionpackRubyGems |
6.0.0 up to 6.0.3.5, plus listed versions 6.0.16.0.1.rc16.0.26.0.2.16.0.2.2 Show 8 moreShow less6.0.2.rc16.0.2.rc26.0.36.0.3.16.0.3.26.0.3.36.0.3.46.0.3.rc1 |
6.0.3.5 |
actionpackRubyGems |
6.1.0 up to 6.1.2.1, plus listed versions 6.1.16.1.2 |
6.1.2.1 |
railsUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:4.1.10-12:4.2.5-12:4.2.5.1-12:4.2.5.2-22:4.2.6-12:4.2.6-1ubuntu0.1~esm12:4.2.6-1ubuntu0.1~esm2 |
None known |
railsUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2:4.2.9-22:4.2.9-42:4.2.10-0ubuntu42:4.2.10-0ubuntu4+esm12:4.2.10-0ubuntu4+esm2 |
None known |
railsUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2:5.2.2.1+dfsg-1ubuntu12:5.2.3+dfsg-32:5.2.3+dfsg-3ubuntu0.1~esm1 |
None known |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
railsUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2:6.0.3.7+dfsg-22:6.1.4.1+dfsg-8ubuntu22:6.1.4.1+dfsg-8ubuntu2+esm1 |
None known |
railsUbuntu:24.04:LTS |
All versions, plus listed versions 2:6.1.7.3+dfsg-2build12:6.1.7.3+dfsg-3 |
None known |
railsUbuntu:25.10 |
All versions, plus listed versions 2:6.1.7.3+dfsg-72:7.2.2.1+dfsg-7 |
None known |
railsUbuntu:26.10 |
All versions, plus listed versions 2:7.2.3+dfsg-22:7.2.3.2+dfsg-2 |
None known |
railsUbuntu:26.04:LTS |
All versions, plus listed versions 2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-22:7.2.3+dfsg-2 |
None known |
rubygem-actionpack-6.0openSUSE:Tumbleweed From an advisory covering 12 CVEs |
before 6.0.4.4-1.1 | 6.0.4.4-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Ruby on Rails - Open Redirect via Host Header Injection |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-22881 is a medium vulnerability (CVSS 6.1) in Fedoraproject Fedora, published February 11, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 87.3%, the 99th percentile. Fixed in actionpack 6.0.3.5.
References
hackerone.com/reports/1047447
discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130
benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3
openwall.com/lists/oss-security/2021/05/05/2
Show 25 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-22881
rubygems.org/gems/actionpack
github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22881.yml
groups.google.com/g/rubyonrails-security/c/zN_3qA26l6E
security-tracker.debian.org/tracker/CVE-2021-22881
ubuntu.com/security/CVE-2021-22881
cve.org/CVERecord?id=CVE-2021-22881
suse.com/security/cve/CVE-2019-16782