{"id":"CVE-2024-26144","aliases":["BIT-rails-2024-26144","DEBIAN-CVE-2024-26144","DSA-5881-1","EUVD-2024-0573","GHSA-8h22-8cf7-hq6g","OESA-2024-1364","OESA-2024-1365","OESA-2024-1366","OESA-2024-1367","RHSA-2024:10806","UBUNTU-CVE-2024-26144"],"status":"published","title":"Possible Sensitive Session Information Leak in Active Storage","description":"Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0125,"percentile":0.6981,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-200"],"published":"2024-02-27T15:44:04Z","modified":"2026-11-02T12:01:01Z","exploits":[{"source":"pocgithub","id":"usutani/study-turbolinks-link","title":"usutani/study-turbolinks-link","date":"2020-04-05","url":"https://github.com/usutani/study-turbolinks-link"},{"source":"pocgithub","id":"gmo-ierae/CVE-2024-26144-test","title":"gmo-ierae/CVE-2024-26144-test","date":"2024-05-24","url":"https://github.com/gmo-ierae/CVE-2024-26144-test"}],"fixes":[{"ecosystem":"RubyGems","package":"activestorage","fixed_in":["6.1.7.7","7.0.8.1"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"rails","fixed_in":["6.1.8","7.0.9"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rails","fixed_in":["2:6.1.7.10+dfsg-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rails","fixed_in":["2:7.2.2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rails","fixed_in":["2:7.2.2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"rubygem-activestorage","fixed_in":["6.1.4.1-2.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"rubygem-activestorage","fixed_in":["6.1.4.1-2.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"rubygem-activestorage","fixed_in":["6.1.4.1-2.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"rubygem-activestorage","fixed_in":["6.1.4.1-2.oe2203sp3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"activestorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"6.1.7.7"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"activestorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.8.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"rails","ranges":[{"type":"SEMVER","events":[{"introduced":"5.2.0"},{"fixed":"6.1.8"},{"introduced":"7.0.0"},{"fixed":"7.0.9"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.1.7.10+dfsg-1~deb12u1"}]}],"versions":["2:6.1.7.3+dfsg-1","2:6.1.7.3+dfsg-10","2:6.1.7.3+dfsg-11","2:6.1.7.3+dfsg-12","2:6.1.7.3+dfsg-13","2:6.1.7.3+dfsg-2","2:6.1.7.3+dfsg-2~deb12u1","2:6.1.7.3+dfsg-3","2:6.1.7.3+dfsg-4","2:6.1.7.3+dfsg-5","2:6.1.7.3+dfsg-6","2:6.1.7.3+dfsg-7","2:6.1.7.3+dfsg-7~exp1","2:6.1.7.3+dfsg-8","2:6.1.7.3+dfsg-9"]},{"source":"osv","ecosystem":"Debian:13","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.2.2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.2.2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.1.7.10+dfsg-1~deb12u1"}]}],"versions":["2:6.1.7.3+dfsg-1","2:6.1.7.3+dfsg-10","2:6.1.7.3+dfsg-11","2:6.1.7.3+dfsg-12","2:6.1.7.3+dfsg-13","2:6.1.7.3+dfsg-2","2:6.1.7.3+dfsg-2~deb12u1","2:6.1.7.3+dfsg-3","2:6.1.7.3+dfsg-4","2:6.1.7.3+dfsg-5","2:6.1.7.3+dfsg-6","2:6.1.7.3+dfsg-7","2:6.1.7.3+dfsg-7~exp1","2:6.1.7.3+dfsg-8","2:6.1.7.3+dfsg-9"],"bundled":9},{"source":"osv","ecosystem":"RubyGems","package":"activestorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"6.1.7.7"}]}],"versions":["5.2.0","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6"]},{"source":"osv","ecosystem":"RubyGems","package":"activestorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.8.1"}]}],"versions":["7.0.0","7.0.1","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"rubygem-activestorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4.1-2.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"rubygem-activestorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4.1-2.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"rubygem-activestorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4.1-2.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"rubygem-activestorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4.1-2.oe2203sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-pulp-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.9-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-pulp-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.9-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-pulp-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.9-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-pulp-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.16.9-2.el8pc"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.8.1-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"rubygem-rack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.8.1-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"rubygem-activestorage","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.7-1.el8sat"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.1.10-1","2:4.2.5-1","2:4.2.5.1-1","2:4.2.5.2-2","2:4.2.6-1","2:4.2.6-1ubuntu0.1~esm1","2:4.2.6-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.2.9-2","2:4.2.9-4","2:4.2.10-0ubuntu4","2:4.2.10-0ubuntu4+esm1","2:4.2.10-0ubuntu4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:5.2.2.1+dfsg-1ubuntu1","2:5.2.3+dfsg-3","2:5.2.3+dfsg-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.0.3.7+dfsg-2","2:6.1.4.1+dfsg-8ubuntu2","2:6.1.4.1+dfsg-8ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.1.7.3+dfsg-2build1","2:6.1.7.3+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.1.7.3+dfsg-7","2:7.2.2.1+dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.2.3+dfsg-2","2:7.2.3.2+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.2.2.1+dfsg-7","2:7.2.2.2+dfsg-2","2:7.2.3+dfsg-2"]}],"products":[{"vendor":"rails","product":"rails"},{"vendor":"rubyonrails","product":"rails"}],"references":[{"url":"https://github.com/rails/rails/security/advisories/GHSA-8h22-8cf7-hq6g","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web","advisory","report"]},{"url":"https://github.com/rails/rails/commit/723f54566023e91060a67b03353e7c03e7436433","tags":["x_refsource_MISC","x_transferred","Patch","web","fix","report"]},{"url":"https://github.com/rails/rails/commit/78fe149509fac5b05e54187aaaef216fbb5fd0d3","tags":["x_refsource_MISC","x_transferred","Patch","web","fix","report"]},{"url":"https://discuss.rubyonrails.org/t/possible-sensitive-session-information-leak-in-active-storage/84945","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web","report"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2024-26144.yml","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web","advisory","article","report"]},{"url":"https://security.netapp.com/advisory/ntap-20240510-0013/","tags":["x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26144","tags":["web","advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26144.yml","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20240510-0013","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8h22-8cf7-hq6g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26144.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-26144","tags":["advisory"]},{"url":"https://github.com/rails/rails","tags":["package"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1364","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1365","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1366","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1367","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10806","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_satellite/6.15/html/updating_red_hat_satellite/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2259780","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2265593","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2265594","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2265595","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2266063","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-28466","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28665","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28689","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28690","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28691","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28693","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28695","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28696","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-28697","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10806.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23342","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23342","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23342","tags":["advisory"]},{"url":"https://github.com/tlsfuzzer/python-ecdsa/blob/master/SECURITY.md","tags":["article"]},{"url":"https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-wj6h-64fc-37mp","tags":["article"]},{"url":"https://minerva.crocs.fi.muni.cz/","tags":["article"]},{"url":"https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-25126","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-25126","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25126","tags":["advisory"]},{"url":"https://discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-26141","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-26141","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26141","tags":["advisory"]},{"url":"https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-26144","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-26144","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-26146","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-26146","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26146","tags":["advisory"]},{"url":"https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2024-26144","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-26144","title":"Possible Sensitive Session Information Leak in Active Storage","description":"Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.","status":"published","published":"2024-02-27T15:44:04.166Z","modified":"2025-02-13T17:41:06.989Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:33:59.884489Z"}],"euvd":[{"id":"EUVD-2024-0573","description":"Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.","status":"published","published":"2024-02-27T15:44:04Z","modified":"2025-02-13T17:41:06Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:03:46.532099Z"}],"ghsa":[{"id":"GHSA-8h22-8cf7-hq6g","title":"Rails has possible Sensitive Session Information Leak in Active Storage","description":"# Possible Sensitive Session Information Leak in Active Storage\n\nThere is a possible sensitive session information leak in Active Storage.  By\ndefault, Active Storage sends a `Set-Cookie` header along with the user's\nsession cookie when serving blobs.  It also sets `Cache-Control` to public.\nCertain proxies may cache the Set-Cookie, leading to an information leak.\n\nThis vulnerability has been assigned the CVE identifier CVE-2024-26144.\n\nVersions Affected:  \u003e= 5.2.0, \u003c 7.1.0\nNot affected:       \u003c 5.2.0, \u003e 7.1.0\nFixed Versions:     7.0.8.1, 6.1.7.7\n\nImpact\n------\nA proxy which chooses to caches this request can cause users to share\nsessions. This may include a user receiving an attacker's session or vice\nversa.\n\nThis was patched in 7.1.0 but not previously identified as a security\nvulnerability.\n\nAll users running an affected release should either upgrade or use one of the\nworkarounds immediately.\n\nReleases\n--------\nThe fixed releases are available at the normal locations.\n\nWorkarounds\n-----------\nUpgrade to Rails 7.1.X, or configure caching proxies not to cache the\nSet-Cookie headers.\n\nCredits\n-------\n\nThanks to [tyage](https://hackerone.com/tyage) for reporting this!","status":"published","published":"2024-02-27T21:41:16Z","modified":"2026-03-15T05:05:22Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:39:36.642723Z"}],"nvd":[{"id":"CVE-2024-26144","description":"Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.","status":"published","published":"2024-02-27T16:15:46.97Z","modified":"2026-06-17T07:17:11.48Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:09:38.473056Z"}],"osv":[{"id":"CVE-2024-26144","title":"Possible Sensitive Session Information Leak in Active Storage","description":"Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.","status":"published","published":"2024-02-27T15:44:04.166Z","modified":"2026-10-28T02:30:56.814771062Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:39.244433Z"},{"id":"DEBIAN-CVE-2024-26144","description":"Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.","status":"published","published":"2024-02-27T16:15:46.97Z","modified":"2026-11-02T12:01:01.07238731Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"GHSA-8h22-8cf7-hq6g","title":"Rails has possible Sensitive Session Information Leak in Active Storage","description":"# Possible Sensitive Session Information Leak in Active Storage\n\nThere is a possible sensitive session information leak in Active Storage.  By\ndefault, Active Storage sends a `Set-Cookie` header along with the user's\nsession cookie when serving blobs.  It also sets `Cache-Control` to public.\nCertain proxies may cache the Set-Cookie, leading to an information leak.\n\nThis vulnerability has been assigned the CVE identifier CVE-2024-26144.\n\nVersions Affected:  \u003e= 5.2.0, \u003c 7.1.0\nNot affected:       \u003c 5.2.0, \u003e 7.1.0\nFixed Versions:     7.0.8.1, 6.1.7.7\n\nImpact\n------\nA proxy which chooses to caches this request can cause users to share\nsessions. This may include a user receiving an attacker's session or vice\nversa.\n\nThis was patched in 7.1.0 but not previously identified as a security\nvulnerability.\n\nAll users running an affected release should either upgrade or use one of the\nworkarounds immediately.\n\nReleases\n--------\nThe fixed releases are available at the normal locations.\n\nWorkarounds\n-----------\nUpgrade to Rails 7.1.X, or configure caching proxies not to cache the\nSet-Cookie headers.\n\nCredits\n-------\n\nThanks to [tyage](https://hackerone.com/tyage) for reporting this!","status":"published","published":"2024-02-27T21:41:16Z","modified":"2026-09-10T03:50:05.469654069Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"OESA-2024-1364","title":"rubygem-activestorage security update","description":"Attach cloud and local files in Rails applications.\r\n\r\nSecurity Fix(es):\r\n\r\nRails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user\u0026apos;s session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.(CVE-2024-26144)","status":"published","published":"2024-04-12T11:06:48Z","modified":"2026-08-18T01:17:14.437778267Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1365","title":"rubygem-activestorage security update","description":"Attach cloud and local files in Rails applications.\r\n\r\nSecurity Fix(es):\r\n\r\nRails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user\u0026apos;s session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.(CVE-2024-26144)","status":"published","published":"2024-04-12T11:06:48Z","modified":"2026-08-18T01:17:15.051633186Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1366","title":"rubygem-activestorage security update","description":"Attach cloud and local files in Rails applications.\r\n\r\nSecurity Fix(es):\r\n\r\nRails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user\u0026apos;s session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.(CVE-2024-26144)","status":"published","published":"2024-04-12T11:06:48Z","modified":"2026-08-18T01:17:15.002988263Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1367","title":"rubygem-activestorage security update","description":"Attach cloud and local files in Rails applications.\r\n\r\nSecurity Fix(es):\r\n\r\nRails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user\u0026apos;s session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.(CVE-2024-26144)","status":"published","published":"2024-04-12T11:06:48Z","modified":"2026-08-18T01:17:12.983880665Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHSA-2024:10806","title":"Red Hat Security Advisory: Satellite 6.15.5 Async Update","status":"published","published":"2024-12-05T10:02:41Z","modified":"2026-09-18T10:02:53Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"UBUNTU-CVE-2024-26144","description":"Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.","status":"published","published":"2024-02-27T16:15:00Z","modified":"2026-10-17T12:56:43.927697256Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:44.862765Z"},{"id":"BIT-rails-2024-26144","title":"Possible Sensitive Session Information Leak in Active Storage","description":"Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.","status":"published","published":"2024-12-20T09:50:06.835Z","modified":"2025-05-20T10:02:07.006Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"DSA-5881-1","title":"rails - security update","status":"published","published":"2025-03-17T00:00:00Z","modified":"2026-03-09T02:09:54.381319Z","updated_at":"2026-11-02T15:46:17.892347Z"}]}}