{"id":"CVE-2026-126073","aliases":["GHSA-r9jg-fmfx-2gv6"],"url":"https://o3.security/vulnerability/CVE-2026-126073","summary":"Action Pack: Possible cache poisoning in Action Pack content negotiation","details":"### Impact\nAction Pack negotiates the format of a rendered response from the `Accept`, `X-Requested-With` and, for XHR requests without `Accept`, `Content-Type` request headers, but `ActionController::Rendering#_set_vary_header` adds `Vary: Accept` only when the request carries a usable `Accept` header and the response has no `Vary` header yet. A response to a request without `Accept`, or to an XHR request, therefore omits the headers that selected its representation, and a response whose `Vary` the application set before rendering (for example `Vary: Accept-Language`) never gains `Accept`. A shared cache that honours `Vary` could store such a response and serve it to later clients that request a different representation, possibly leading to cache poisoning in which visitors receive, until the entry expires, a page without its layout or HTML in place of JSON. The attacker cannot choose the content of the response.\n\nApplications that render negotiated responses from actions marked `public` (for example with `expires_in ..., public: true`) behind a shared cache that honours `Vary`, such as Thruster or `Rack::Cache`, are affected.\n\n### Details\nIn the fixed releases, a rendered response whose format is not given by the URL lists `Accept` and `X-Requested-With` in `Vary`, and also `Content-Type` for an XHR request without `Accept`; when `config.action_dispatch.ignore_accept_header` is enabled, it lists only `X-Requested-With`. These fields are appended to an existing `Vary` value rather than skipped, and `Vary: *` is left unchanged. Shared caches can store more variants of such responses than before. See the Action Pack CHANGELOG for details.\n\n### Workarounds\nSet `Vary: Accept, X-Requested-With` on negotiated responses in the application, for example in an `after_action`, or do not mark negotiated responses `public`.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\nPatches for those who cannot upgrade at once:\n- 8.1: https://github.com/rails/rails/commit/7a955ca36779938267c93902c47d1f55bab99b4b.patch\n- 8.0: https://github.com/rails/rails/commit/b58c107abe9c1f10c1d6a4941402c60e4dc4742c.patch\n\n### Credit\nThis issue was found by the Anthropic OSS Scanner (ANT-2026-7GHGLQGO, ANT-2026-5MT6C2R3).","published":"2026-11-10T20:46:43.153Z","modified":"2026-11-11T10:47:26.544476422Z","cvss":{"score":4.8,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"RubyGems","name":"actionpack","fixedVersion":"8.1.4.1"},{"ecosystem":"RubyGems","name":"actionpack","fixedVersion":"8.0.5.2"}],"fix":{"url":"https://github.com/rails/rails/commit/7a955ca36779938267c93902c47d1f55bab99b4b","label":"rails/rails@7a955ca"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126073.json"},{"type":"FIX","url":"https://github.com/rails/rails/commit/7a955ca36779938267c93902c47d1f55bab99b4b"},{"type":"FIX","url":"https://github.com/rails/rails/commit/b58c107abe9c1f10c1d6a4941402c60e4dc4742c"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.0.5.2"},{"type":"WEB","url":"https://github.com/rails/rails/releases/tag/v8.1.4.1"},{"type":"ADVISORY","url":"https://github.com/rails/rails/security/advisories/GHSA-r9jg-fmfx-2gv6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126073"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/GHSA-r9jg-fmfx-2gv6.yml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-11T10:47:26.544476422Z"}}