Every CVE Search/ Get API key

CVE-2024-47888

Action Text has possible ReDoS vulnerability in plain_text_for_blockquote_node

6.6 MediumFix available

Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the plain_text_for_blockquote_node helper in Action Text. Carefully crafted text can cause the plain_text_for_blockquote_node helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. As a workaround, users can avoid calling plain_text_for_blockquote_node or upgrade to Ruby 3.2. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.98%Up 0.9 points since Oct 17, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.6

Action Text has possible ReDoS vulnerability in plain_text_for_blockquote_node

Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the plain_text_for_blockquote_node helper in Action Text. Carefully crafted text can cause the plain_text_for_blockquote_node helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. As a workaround, users can avoid calling plain_text_for_blockquote_node or upgrade to Ruby 3.2. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Record
CVE-2024-47888
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Weakness
CWE-1333
Updated
2026-11-02
EUVDEUVD-2024-3158 6.6

Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the plain_text_for_blockquote_node helper in Action Text. Carefully crafted text can cause the plain_text_for_blockquote_node helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. As a workaround, users can avoid calling plain_text_for_blockquote_node or upgrade to Ruby 3.2. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Record
EUVD-2024-3158
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Updated
2026-11-03
GitHub AdvisoriesGHSA-wwhv-wxv9-rpgw 6.6

Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text

There is a possible ReDoS vulnerability in the plain_text_for_blockquote_node helper in Action Text. This vulnerability has been assigned the CVE identifier CVE-2024-47888.

Impact

Carefully crafted text can cause the plain_text_for_blockquote_node helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately.

Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Releases

The fixed releases are available at the normal locations.

Workarounds

Users can avoid calling plain_text_for_blockquote_node or upgrade to Ruby 3.2

Credits

Thanks to ooooooo_q for the report!

Record
GHSA-wwhv-wxv9-rpgw
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Weakness
CWE-1333
Updated
2026-11-02
NVD 6.6

Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the plain_text_for_blockquote_node helper in Action Text. Carefully crafted text can cause the plain_text_for_blockquote_node helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. As a workaround, users can avoid calling plain_text_for_blockquote_node or upgrade to Ruby 3.2. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Record
CVE-2024-47888
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-1333
Updated
2026-11-02
OSV 6.6

Action Text has possible ReDoS vulnerability in plain_text_for_blockquote_node

Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the plain_text_for_blockquote_node helper in Action Text. Carefully crafted text can cause the plain_text_for_blockquote_node helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. As a workaround, users can avoid calling plain_text_for_blockquote_node or upgrade to Ruby 3.2. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Record
CVE-2024-47888
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Weakness
CWE-1333
Updated
2026-11-02
OSVDEBIAN-CVE-2024-47888 6.6

Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the plain_text_for_blockquote_node helper in Action Text. Carefully crafted text can cause the plain_text_for_blockquote_node helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. As a workaround, users can avoid calling plain_text_for_blockquote_node or upgrade to Ruby 3.2. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Record
DEBIAN-CVE-2024-47888
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 8 moreShow less
OSVGHSA-wwhv-wxv9-rpgw 6.6

Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text

There is a possible ReDoS vulnerability in the plain_text_for_blockquote_node helper in Action Text. This vulnerability has been assigned the CVE identifier CVE-2024-47888.

Impact

Carefully crafted text can cause the plain_text_for_blockquote_node helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately.

Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Releases

The fixed releases are available at the normal locations.

Workarounds

Users can avoid calling plain_text_for_blockquote_node or upgrade to Ruby 3.2

Credits

Thanks to ooooooo_q for the report!

Record
GHSA-wwhv-wxv9-rpgw
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Weakness
CWE-1333
Updated
2026-11-02
OSVUBUNTU-CVE-2024-47888 6.6

Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the plain_text_for_blockquote_node helper in Action Text. Carefully crafted text can cause the plain_text_for_blockquote_node helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. As a workaround, users can avoid calling plain_text_for_blockquote_node or upgrade to Ruby 3.2. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Record
UBUNTU-CVE-2024-47888
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Updated
2026-11-02
OSVBIT-rails-2024-47888 No score

Action Text has possible ReDoS vulnerability in plain_text_for_blockquote_node

Action Text brings rich text content and editing to Rails. Starting in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the plain_text_for_blockquote_node helper in Action Text. Carefully crafted text can cause the plain_text_for_blockquote_node helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. As a workaround, users can avoid calling plain_text_for_blockquote_node or upgrade to Ruby 3.2. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Record
BIT-rails-2024-47888
Updated
2026-11-02
OSVopenSUSE-SU-2024:14473-1 No score

ruby3.3-rubygem-actiontext-7.0-7.0.8.6-1.1 on GA media

These are all security issues fixed in the ruby3.3-rubygem-actiontext-7.0-7.0.8.6-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14473-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14479-1 No score

ruby3.3-rubygem-rails-7.0-7.0.8.6-1.1 on GA media

These are all security issues fixed in the ruby3.3-rubygem-rails-7.0-7.0.8.6-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14479-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15111-1 No score

ruby3.4-rubygem-actiontext-7.0-7.0.8.6-1.3 on GA media

These are all security issues fixed in the ruby3.4-rubygem-actiontext-7.0-7.0.8.6-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15111-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15124-1 No score

ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3 on GA media

These are all security issues fixed in the ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15124-1
Updated
2026-11-02
OSVUSN-7290-1 No score

rails vulnerabilities

It was discovered that Rails did not correctly handle parsing block formats in email service layers. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-47889)

It was discovered that Rails did not correctly handle parsing block quotes in rich text content. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-47888)

It was discovered that Rails did not correctly handle parsing HTTP token authentication headers. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-47887)

It was discovered that Rails did not correctly handle parsing query parameters in web requests. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-41128)

Record
USN-7290-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
actiontext
RubyGems
 6.0.0 up to 6.1.7.9
6.1.7.9
actiontext
RubyGems
 7.0.0 up to 7.0.8.5
7.0.8.5
actiontext
RubyGems
 7.1.0 up to 7.1.4.1
7.1.4.1
actiontext
RubyGems
 7.2.0 up to 7.2.1.1
7.2.1.1
rails
Bitnami
 6.0.0 up to 6.1.8, 7.0.0 up to 7.0.9, 7.1.0 up to 7.1.4, 7.2.0 up to 7.2.2
6.1.87.0.97.1.47.2.2
rails
Debian:12
 before 2:6.1.7.10+dfsg-1~deb12u1, plus listed versions
2:6.1.7.3+dfsg-12:6.1.7.3+dfsg-102:6.1.7.3+dfsg-112:6.1.7.3+dfsg-122:6.1.7.3+dfsg-13
Show 10 moreShow less
2:6.1.7.3+dfsg-22:6.1.7.3+dfsg-2~deb12u12:6.1.7.3+dfsg-32:6.1.7.3+dfsg-42:6.1.7.3+dfsg-52:6.1.7.3+dfsg-62:6.1.7.3+dfsg-72:6.1.7.3+dfsg-7~exp12:6.1.7.3+dfsg-82:6.1.7.3+dfsg-9
2:6.1.7.10+dfsg-1~deb12u1
rails
Debian:13
 before 2:7.2.2.1+dfsg-1
2:7.2.2.1+dfsg-1
rails
Debian:14
 before 2:7.2.2.1+dfsg-1
2:7.2.2.1+dfsg-1
rails
Debian:11
From an advisory covering 8 CVEs
 before 2:6.0.3.7+dfsg-2+deb11u3, plus listed versions
2:6.0.3.7+dfsg-22:6.0.3.7+dfsg-2+deb11u12:6.0.3.7+dfsg-2+deb11u2
2:6.0.3.7+dfsg-2+deb11u3
rails
Debian:12
From an advisory covering 9 CVEs
 before 2:6.1.7.10+dfsg-1~deb12u1, plus listed versions
2:6.1.7.3+dfsg-12:6.1.7.3+dfsg-102:6.1.7.3+dfsg-112:6.1.7.3+dfsg-122:6.1.7.3+dfsg-13
Show 10 moreShow less
2:6.1.7.3+dfsg-22:6.1.7.3+dfsg-2~deb12u12:6.1.7.3+dfsg-32:6.1.7.3+dfsg-42:6.1.7.3+dfsg-52:6.1.7.3+dfsg-62:6.1.7.3+dfsg-72:6.1.7.3+dfsg-7~exp12:6.1.7.3+dfsg-82:6.1.7.3+dfsg-9
2:6.1.7.10+dfsg-1~deb12u1
Show 20 moreShow less
Affected packages
PackageAffectedFixed
actiontext
RubyGems
 6.0.0 up to 6.1.7.9, plus listed versions
6.0.16.0.1.rc16.0.26.0.2.16.0.2.2
Show 45 moreShow less
6.0.2.rc16.0.2.rc26.0.36.0.3.16.0.3.26.0.3.36.0.3.46.0.3.56.0.3.66.0.3.76.0.3.rc16.0.46.0.4.16.0.4.26.0.4.36.0.4.46.0.4.56.0.4.66.0.4.76.0.4.86.0.56.0.5.16.0.66.0.6.16.1.06.1.0.rc16.1.0.rc26.1.16.1.26.1.2.16.1.36.1.3.16.1.3.26.1.46.1.4.16.1.4.26.1.4.36.1.4.46.1.4.56.1.4.66.1.4.76.1.56.1.5.16.1.66.1.6.1
6.1.7.9
actiontext
RubyGems
 7.0.0 up to 7.0.8.5, plus listed versions
7.0.17.0.27.0.2.17.0.2.27.0.2.3
Show 18 moreShow less
7.0.2.47.0.37.0.3.17.0.47.0.4.17.0.4.27.0.4.37.0.57.0.5.17.0.67.0.77.0.7.17.0.7.27.0.87.0.8.17.0.8.27.0.8.37.0.8.4
7.0.8.5
actiontext
RubyGems
 7.1.0 up to 7.1.4.1, plus listed versions
7.1.17.1.27.1.37.1.3.17.1.3.27.1.3.37.1.3.47.1.4
7.1.4.1
actiontext
RubyGems
 7.2.0 up to 7.2.1.1, plus listed versions
7.2.1
7.2.1.1
rails
Ubuntu:Pro:16.04:LTS
 before 2:4.2.6-1ubuntu0.1~esm1, plus listed versions
2:4.1.10-12:4.2.5-12:4.2.5.1-12:4.2.5.2-22:4.2.6-1
2:4.2.6-1ubuntu0.1~esm1
rails
Ubuntu:Pro:18.04:LTS
 before 2:4.2.10-0ubuntu4+esm1, plus listed versions
2:4.2.9-22:4.2.9-42:4.2.10-0ubuntu4
2:4.2.10-0ubuntu4+esm1
rails
Ubuntu:Pro:20.04:LTS
 before 2:5.2.3+dfsg-3ubuntu0.1~esm1, plus listed versions
2:5.2.2.1+dfsg-1ubuntu12:5.2.3+dfsg-3
2:5.2.3+dfsg-3ubuntu0.1~esm1
rails
Ubuntu:Pro:22.04:LTS
 before 2:6.1.4.1+dfsg-8ubuntu2+esm1, plus listed versions
2:6.0.3.7+dfsg-22:6.1.4.1+dfsg-8ubuntu2
2:6.1.4.1+dfsg-8ubuntu2+esm1
rails
Ubuntu:24.04:LTS
 All versions, plus listed versions
2:6.1.7.3+dfsg-2build12:6.1.7.3+dfsg-3
 None known
rails
Ubuntu:25.10
 All versions, plus listed versions
2:6.1.7.3+dfsg-72:7.2.2.1+dfsg-7
 None known
rails
Ubuntu:26.10
 All versions, plus listed versions
2:7.2.3+dfsg-22:7.2.3.2+dfsg-2
 None known
rails
Ubuntu:26.04:LTS
 All versions, plus listed versions
2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-22:7.2.3+dfsg-2
 None known
rails
Ubuntu:Pro:16.04:LTS
From an advisory covering 4 CVEs
 before 2:4.2.6-1ubuntu0.1~esm1, plus listed versions
2:4.1.10-12:4.2.5-12:4.2.5.1-12:4.2.5.2-22:4.2.6-1
2:4.2.6-1ubuntu0.1~esm1
rails
Ubuntu:Pro:18.04:LTS
From an advisory covering 4 CVEs
 before 2:4.2.10-0ubuntu4+esm1, plus listed versions
2:4.2.9-22:4.2.9-42:4.2.10-0ubuntu4
2:4.2.10-0ubuntu4+esm1
rails
Ubuntu:Pro:20.04:LTS
From an advisory covering 4 CVEs
 before 2:5.2.3+dfsg-3ubuntu0.1~esm1, plus listed versions
2:5.2.2.1+dfsg-1ubuntu12:5.2.3+dfsg-3
2:5.2.3+dfsg-3ubuntu0.1~esm1
rails
Ubuntu:Pro:22.04:LTS
From an advisory covering 4 CVEs
 before 2:6.1.4.1+dfsg-8ubuntu2+esm1, plus listed versions
2:6.0.3.7+dfsg-22:6.1.4.1+dfsg-8ubuntu2
2:6.1.4.1+dfsg-8ubuntu2+esm1
rubygem-actiontext-7.0
openSUSE:Tumbleweed
 before 7.0.8.6-1.1
7.0.8.6-1.1
rubygem-rails-7.0
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 7.0.8.6-1.1
7.0.8.6-1.1
rubygem-actiontext-7.0
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 7.0.8.6-1.3
7.0.8.6-1.3
rubygem-rails-7.0
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
 before 7.0.8.6-1.3
7.0.8.6-1.3

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-47888 is a medium vulnerability (CVSS 6.6) in Rails, published October 15, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.98%, the 62nd percentile. Fixed in actiontext 6.1.7.9.

References

Show 23 moreShow less
This page doesn't list everything

Left out here: 9 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open