{"id":"CVE-2022-23633","aliases":["GHSA-wh98-p28r-vrc9"],"url":"https://o3.security/vulnerability/CVE-2022-23633","summary":"Exposure of sensitive information in Action Pack","details":"### Impact\n\nUnder certain circumstances response bodies will not be closed, for example a [bug in a webserver](https://github.com/puma/puma/pull/2812) or a bug in a Rack middleware.  In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request.  This can lead to data being leaked to subsequent requests, especially when interacting with `ActiveSupport::CurrentAttributes`.\n\nUpgrading to the FIXED versions of Rails will ensure mitigation of this issue even in the context of a buggy webserver or middleware implementation.\n\n### Patches\n\nThis has been fixed in Rails 7.0.2.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.\n\n### Workarounds\n\nUpgrading is highly recommended, but to work around this problem the following middleware can be used:\n\n```ruby\nclass GuardedExecutor < ActionDispatch::Executor\n  def call(env)\n    ensure_completed!\n    super\n  end\n\n  private\n\n    def ensure_completed!\n      @executor.new.complete! if @executor.active?\n    end\nend\n\n# Ensure the guard is inserted before ActionDispatch::Executor\nRails.application.configure do\n  config.middleware.swap ActionDispatch::Executor, GuardedExecutor, executor\nend\n```","published":"2022-02-11T00:00:00Z","modified":"2026-09-09T03:45:10.040118888Z","cvss":{"score":7.4,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},"epss":{"score":0.02226,"percentile":0.81846,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"actionpack","fixedVersion":"5.2.6.2"},{"ecosystem":"RubyGems","name":"actionpack","fixedVersion":"6.0.4.6"},{"ecosystem":"RubyGems","name":"actionpack","fixedVersion":"6.1.4.6"},{"ecosystem":"RubyGems","name":"actionpack","fixedVersion":"7.0.2.2"}],"fix":{"url":"https://github.com/rails/rails/commit/f9a2ad03943d5c2ba54e1d45f155442b519c75da","label":"rails/rails@f9a2ad0"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23633.json"},{"type":"ADVISORY","url":"https://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23633"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20240119-0013/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2023/dsa-5372"},{"type":"FIX","url":"https://github.com/rails/rails/commit/f9a2ad03943d5c2ba54e1d45f155442b519c75da"},{"type":"ARTICLE","url":"http://www.openwall.com/lists/oss-security/2022/02/11/5"},{"type":"ARTICLE","url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html"},{"type":"WEB","url":"https://discuss.rubyonrails.org/t/cve-2022-23633-possible-exposure-of-information-vulnerability-in-action-pack/80016"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2022-23633.yml"},{"type":"WEB","url":"https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ"},{"type":"WEB","url":"https://rubyonrails.org/2022/2/11/Rails-7-0-2-2-6-1-4-6-6-0-4-6-and-5-2-6-2-have-been-released"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240119-0013"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-09T03:45:10.040118888Z"}}