Active Support vulnerabilities

Active Support (a Ruby library from Rails) before versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 accepts strings in scientific notation (e.g. 1e10000) in number helpers, which BigDecimal expands into extremely large decimals. Formatting such a number causes excessive memory allocation and CPU consumption.

In Active Support (Ruby on Rails), SafeBuffer#% does not propagate the @html_unsafe flag to the newly created buffer. If a SafeBuffer is mutated in place (e.g., via gsub!) and then formatted with % using untrusted arguments, the result incorrectly reports html_safe? == true, bypassing ERB auto-escaping and possibly leading to XSS.

Active Support is a Ruby support library extracted from the Rails framework. NumberToDelimitedConverter uses a lookahead-based regular expression with gsub!, which can cause quadratic time complexity on long digit strings. The issue is patched in versions 8.1.2.1, 8.0.4.1, and 7.2.3.1.

A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter catastrophic backtracking, causing the process to use large amounts of CPU and memory.