Rails security fixes expose different boundaries inside one request
The coordinated releases repair controller translation escaping, Accept parsing and Active Storage session handling. Each issue has different affected versions and application conditions.
A response that can be shared by a cache should not also distribute one visitor's session to another. Active Storage's proxy responses could combine public caching with a session cookie, allowing certain proxies to produce exactly that result. It is one of several distinct request-handling problems addressed by today's Rails security releases.
The February 21 release announcement publishes Rails 6.1.7.7, 7.0.8.1 and 7.1.3.2. The 7.1.3.2 update follows 7.1.3.1 on the same day to correct a small regression. These version numbers are not interchangeable because the underlying vulnerabilities affect different release lines.
I find Ruby's readable interfaces useful, but a framework method can carry substantial behavior behind a short call. These fixes are instructive because each concerns information that acquired a meaning the application author might not expect, whether as trusted HTML, parsing work or a cacheable session-bearing response.
Shared caching conflicts with session-bearing output
The Active Storage advisory for CVE-2024-26144 describes blob responses that send Set-Cookie together with public Cache-Control. A proxy that caches that header can cause users to share sessions. The advisory explicitly includes both a victim receiving an attacker's session and the reverse direction.
The affected range is Rails 5.2 through versions before 7.1. The behavior was already corrected in 7.1.0 without having been recognized as a security vulnerability at that time. Today's fixes bring the correction to 7.0.8.1 and 6.1.7.7.
The 7.0 patch adds a session-disabling concern to the blob and representation proxy controllers. Its callback sets request.session_options[:skip] = true. That is a targeted change to the controllers producing publicly cacheable content.
The correction avoids attaching session state to that shared response path. It does not require claiming that every proxy caches Set-Cookie, or that every Active Storage deployment has leaked a session. The report concerns proxies that choose to cache these responses with the header present. The problematic combination exists before any particular proxy's policy turns it into cross-user exposure.
The advisory offers configuring caching proxies not to cache Set-Cookie as a workaround. That addresses the intermediary's handling of the response. Updating Rails addresses the session behavior at the source, so the publicly cacheable output no longer depends on that intermediary decision to separate visitors correctly.
Translation defaults can carry untrusted HTML
CVE-2024-26143 concerns controller translation helpers. The reported conditions include a key ending in _html, untrusted unescaped input in the default option, and a result sent to the victim through a view or render operation. A translation call with no such data flow does not establish the reported vulnerability.
The advisory distinguishes controller t or translate calls from I18n.t and translation helpers used directly in views. That scope matters because similarly named helpers can have different escaping responsibilities. Searching for all translation calls and treating them identically would obscure the particular path being corrected.
The controller translation patch escapes string defaults using ERB::Util.html_escape before the HTML-safe translation helper processes them. It handles an array of defaults as well as a single default. This prevents an untrusted fallback string from acquiring the effective authority of a trusted HTML translation.
Its tests also distinguish the content of a missing-translation message from whether the result is marked HTML-safe. That distinction is central to an output-encoding fix. A string can contain angle brackets as data while still requiring escaping when inserted into an HTML document.
The release announcement lists fixes in 7.0.8.1 and the two new 7.1 patch releases. The follow-up to the advisory explains the small regression in 7.1.3.1, which did not respect raise_on_missing_translations for controller translations. Version 7.1.3.2 corrects that regression and contains no other changes relative to 7.1.3.1.
Accept parsing has a runtime-dependent exposure
The Action Dispatch advisory for CVE-2024-26142 identifies excessive parsing time for crafted Accept headers. Its affected Rails range begins at 7.1.0 and ends before 7.1.3.1. The notice also states that applications on Ruby 3.2 or newer are unaffected because the interpreter has mitigations for this problem.
That makes exposure a combination of framework and interpreter versions. A Rails version alone does not capture the advisory's full conditions. The framework correction remains useful as a repair to its parser, while the runtime changes whether this particular parsing pattern can cause the reported denial of service.
The patch removes leading whitespace matching from the regular expression that locates a quality-parameter separator. It then strips whitespace from the selected prefix explicitly. The parser still obtains the trimmed media type, but no longer delegates that leading whitespace handling to the same search pattern.
This is a concrete example of separating normalization from matching. The public advisory supplies no universal execution-time multiplier, so the correction should not be described using an invented performance number. Its purpose is to remove an expensive path through crafted input while preserving the parser's intended result.
One release announcement covers several maintenance obligations
The announcement also points to Rack releases for separate denial-of-service issues. Updating Rails should therefore not be treated as evidence that every related dependency in an application's resolved bundle has changed. The announcement names that additional work explicitly, without conflating Rack's issues with Action Dispatch's Accept parser.
Rails 6.1 receives only critical security updates at this point, according to the release post. That matters for interpreting 6.1.7.7 as a targeted backport. My preference for maintainable application code includes having an accurate account of its framework support. These releases provide specific repairs within their affected lines, with the parser, translation and session advisories supplying the conditions under which each repair matters.