-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 04 Oct 2026 16:13:12 -0500 Source: rails Binary: rails ruby-actioncable ruby-actionmailbox ruby-actionmailer ruby-actionpack ruby-actiontext ruby-actionview ruby-activejob ruby-activemodel ruby-activerecord ruby-activestorage ruby-activesupport ruby-rails ruby-railties Architecture: all Version: 2:7.2.2.2+dfsg-2~deb13u2 Distribution: trixie-security Urgency: high Maintainer: all Build Daemon (x86-grnet-02) Changed-By: Simon Quigley Description: rails - MVC ruby based framework geared for web application development ( ruby-actioncable - WebSocket framework for Rails (part of Rails) ruby-actionmailbox - receive and process incoming emails (part of Rails) ruby-actionmailer - email composition, delivery framework (part of Rails) ruby-actionpack - web-flow and rendering framework putting the VC in MVC (part of R ruby-actiontext - edit and display rich text (part of Rails) ruby-actionview - framework for handling view template lookup and rendering (part o ruby-activejob - job framework with pluggable queues (part of Rails) ruby-activemodel - toolkit for building modeling frameworks (part of Rails) ruby-activerecord - object-relational mapper framework (part of Rails) ruby-activestorage - local and cloud file storage framework (part of Rails) ruby-activesupport - collection of utility classes used by the Rails framework ruby-rails - MVC ruby based framework geared for web application development ruby-railties - tools for creating, working with, and running Rails applications Closes: 1132035 1143080 Changes: rails (2:7.2.2.2+dfsg-2~deb13u2) trixie-security; urgency=high . * CVE-2026-66066: disable libvips unfuzzed loaders and savers when Active Storage loads ruby-vips. BMP, ICO, and PSD variants then raise Vips::Error (Closes: #1143080). * CVE-2026-33168: skip blank HTML attribute names in tag helpers. A blank attribute name bypasses escaping and produces malformed HTML. A crafted value can be read as a separate attribute, possibly leading to XSS (Closes: #1132035). * CVE-2026-33169: delimit numbers without the backtracking expression. The lookahead regular expression and gsub! can take quadratic time on a long digit string (Closes: #1132035). * CVE-2026-33170: keep an unsafe SafeBuffer unsafe after %. SafeBuffer#% does not copy the html_safe flag. Formatting a buffer mutated in place, with untrusted arguments, reports html_safe? and bypasses ERB escaping (Closes: #1132035). * CVE-2026-33173: drop analyzed, identified, and composed from direct uploads. Direct upload metadata can set those flags, skip MIME detection, and claim a safe content_type for other content (Closes: #1132035). * CVE-2026-33174: reject Active Storage byte ranges larger than 100MB. The proxy loads the whole requested byte range into memory. A large or unbounded Range header can exhaust memory. Ranges whose total size reaches 100MB are now rejected (Closes: #1132035). * CVE-2026-33176: do not expand scientific notation in number helpers. Strings such as 1e10000 are expanded by BigDecimal into a huge representation, which can exhaust memory and CPU (Closes: #1132035). * CVE-2026-33195: reject disk keys that leave the Active Storage root. DiskService#path_for does not keep the resolved path inside the storage root. A key containing ../ can read, write, or delete files outside it (Closes: #1132035). * CVE-2026-33202: escape glob metacharacters in DiskService#delete_prefixed. The prefix is passed to Dir.glob without escaping. A key containing glob metacharacters can delete a different file (Closes: #1132035). * CVE-2026-33658: allow only one byte range on Active Storage proxies. The proxy does not limit how many ranges a Range header may contain. Thousands of small ranges use much more CPU than one request for the same file (Closes: #1132035). Checksums-Sha1: 2a7e4d5e791211b8ae5dc4d99fecb8e8aa5be16d 27635 rails_7.2.2.2+dfsg-2~deb13u2_all-buildd.buildinfo cf0a25abb52ec53d89ef25f228d9d0a84b7c39b8 20524 rails_7.2.2.2+dfsg-2~deb13u2_all.deb c6b52e2458a26f7dd5a0ae355e3b22db5cf2b334 61832 ruby-actioncable_7.2.2.2+dfsg-2~deb13u2_all.deb 2450b29f553a8f6dd83e894b1e27f809f39cbc07 38868 ruby-actionmailbox_7.2.2.2+dfsg-2~deb13u2_all.deb 951e8bf2fd257ef28265adfde52b74f8ffcd9d96 46412 ruby-actionmailer_7.2.2.2+dfsg-2~deb13u2_all.deb 3913c4c0b84ae91214f8cfb4b04b59420bf91146 217736 ruby-actionpack_7.2.2.2+dfsg-2~deb13u2_all.deb 59fba810bfc28af6d639f9a949e160008de12c43 132800 ruby-actiontext_7.2.2.2+dfsg-2~deb13u2_all.deb 99b8cfbf646226f25f15baf5ba40cb2b8596d6a5 170920 ruby-actionview_7.2.2.2+dfsg-2~deb13u2_all.deb 3847e976904d20c2714637df3b2241bedb5c37d5 50148 ruby-activejob_7.2.2.2+dfsg-2~deb13u2_all.deb da511161af98c893f8069f435dded630433680c5 76304 ruby-activemodel_7.2.2.2+dfsg-2~deb13u2_all.deb 95d38bafd58d3416e5214d11f5b63ded7f53a6a3 448540 ruby-activerecord_7.2.2.2+dfsg-2~deb13u2_all.deb cd5359c769e5939e5af6b3ff16dcb610a84ea6eb 72340 ruby-activestorage_7.2.2.2+dfsg-2~deb13u2_all.deb 74d5549fc44a824bc5e43a672d8e5e38f7bf6fa2 224220 ruby-activesupport_7.2.2.2+dfsg-2~deb13u2_all.deb 200cd5e2b81c32b39103952a9a5737cdf1a65245 27796 ruby-rails_7.2.2.2+dfsg-2~deb13u2_all.deb dbbd591b7d7caa131886c25ec63cf05ca5467dcb 172588 ruby-railties_7.2.2.2+dfsg-2~deb13u2_all.deb Checksums-Sha256: 0d161922b9c42f3dd804bece48a875513dbb56f547d1896ccf81260e121be9ba 27635 rails_7.2.2.2+dfsg-2~deb13u2_all-buildd.buildinfo cfd033aba298a9ef28e556f2f8da69aa344f7a670389e5018b14ff77036fd1c5 20524 rails_7.2.2.2+dfsg-2~deb13u2_all.deb 25dcb7e581c183df0cf8793ead4ce0ece252bc67b5c12bbd98aa8f8bc7e97828 61832 ruby-actioncable_7.2.2.2+dfsg-2~deb13u2_all.deb 997868f0557f4c42a682f5e95b77b2655853949bb7a6415b5e0bae98b35569d7 38868 ruby-actionmailbox_7.2.2.2+dfsg-2~deb13u2_all.deb 73de411d53cad6a991b225c5cb28abcf3ed0cbe7d56336bc1e5902b92ba0ede2 46412 ruby-actionmailer_7.2.2.2+dfsg-2~deb13u2_all.deb 7d7bd161b8181dce6fff44c5452ccc7f2da8577a973e3933e36389f620ff93f0 217736 ruby-actionpack_7.2.2.2+dfsg-2~deb13u2_all.deb a0b9dd67920d303973bae1bb67b425c8077d764315b98fb514f92bfc55141f7e 132800 ruby-actiontext_7.2.2.2+dfsg-2~deb13u2_all.deb 75fc2a5d65964d16570dad1f40b28827b1ef52f241139bc819e04b760c4deea2 170920 ruby-actionview_7.2.2.2+dfsg-2~deb13u2_all.deb 04c04709608c8eec5f600bda9e66e27be376647c4b7fc37c2bcae6a44c491583 50148 ruby-activejob_7.2.2.2+dfsg-2~deb13u2_all.deb 4e6d4be0eb487cfeac32ae0be8547573852c5b340f5ce421f08a3bab7682144c 76304 ruby-activemodel_7.2.2.2+dfsg-2~deb13u2_all.deb 0f29ea9d4f5c09e7fb5eee3727f85ebb39801b49fe0d58bd13c6359e6111974b 448540 ruby-activerecord_7.2.2.2+dfsg-2~deb13u2_all.deb 2c8230b3fc2d5b70c2e19e62a1467a391dd311ffedec2516293e886fcd027361 72340 ruby-activestorage_7.2.2.2+dfsg-2~deb13u2_all.deb 83c0bc7f4faca772215eee06799da17bed25291943e51a1283a4fbec899971c9 224220 ruby-activesupport_7.2.2.2+dfsg-2~deb13u2_all.deb 8885313ea447bd9ac406b117857d6f56016a99ad7ee75978141fb2a5752d2dfe 27796 ruby-rails_7.2.2.2+dfsg-2~deb13u2_all.deb e1fe31f586c2e0f014516db07065fe4313fd73b57f5bf878f91d17662215fd30 172588 ruby-railties_7.2.2.2+dfsg-2~deb13u2_all.deb Files: 06314e75cfc53c22d73f7e014872f5b4 27635 ruby optional rails_7.2.2.2+dfsg-2~deb13u2_all-buildd.buildinfo 6673f266359ff444505db44ca0df217c 20524 ruby optional rails_7.2.2.2+dfsg-2~deb13u2_all.deb 95989c39d1e1ec93cfee72560a661914 61832 ruby optional ruby-actioncable_7.2.2.2+dfsg-2~deb13u2_all.deb ada5fa52d4212f4918bedfc7bf870bf0 38868 ruby optional ruby-actionmailbox_7.2.2.2+dfsg-2~deb13u2_all.deb 2207537620351205b3161bd5e100105a 46412 ruby optional ruby-actionmailer_7.2.2.2+dfsg-2~deb13u2_all.deb 0bbc664fb410b8e1bb3689c2c9cdeccd 217736 ruby optional ruby-actionpack_7.2.2.2+dfsg-2~deb13u2_all.deb 2d75fbe2a94ade7608bf293136438842 132800 ruby optional ruby-actiontext_7.2.2.2+dfsg-2~deb13u2_all.deb 976aba8ee0702192d7e3dd72eb0d5dcd 170920 ruby optional ruby-actionview_7.2.2.2+dfsg-2~deb13u2_all.deb d7025f298e88f0b45dfbbb7546bf49dc 50148 ruby optional ruby-activejob_7.2.2.2+dfsg-2~deb13u2_all.deb 597d3a2cfa3e83758b0057415ac99b0d 76304 ruby optional ruby-activemodel_7.2.2.2+dfsg-2~deb13u2_all.deb a1025b2449451c2161e7d375e5be37d6 448540 ruby optional ruby-activerecord_7.2.2.2+dfsg-2~deb13u2_all.deb 12cb4b8bbb4543962aadad90a8e5e3ae 72340 ruby optional ruby-activestorage_7.2.2.2+dfsg-2~deb13u2_all.deb a55349f4dd6c16ba291d1450f786ce5d 224220 ruby optional ruby-activesupport_7.2.2.2+dfsg-2~deb13u2_all.deb af7e322deca647eba55b2332f8dbb9bd 27796 ruby optional ruby-rails_7.2.2.2+dfsg-2~deb13u2_all.deb b7f4035e6aa4a5e3ca770f777f205db4 172588 ruby optional ruby-railties_7.2.2.2+dfsg-2~deb13u2_all.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmrD8PMACgkQmgPNRvTf /zeJGRAAmUry3WAN2y4tZpwFwQq9tzrxRdy+tOOsL8yIm8Yp2IeoGPs438VkYR0d 8LN+KVyo6taczg504v3ANbpe1iN1U2My+kRntqbnMPcSO59ZPRsRbSkuTM8aRez4 2hAygzVjoWbOBPN1x8u9Bu/H4l1gk/6HUOfXsFEUDCA1z/hLDxHf5iO9LbrHlzga UmuBsfQhc657zA0LPxeXwClD0b8C80NXQjxRMI4sBNLtVP6b4swfwRk2efKxTlvc ExtqE7dKRabdnmeutR6ITlIGzl4jBgqK3qOWkpF2I4JfJEdFUsfeOWKIMGnzQnEH xhpFX1bZW7+jGt0WUN8H72sju3WgfvHl+ubxOOmJ70E+a5E54L2Jq6iue516VreG 37MK3i1yhJmjaH8/VUFD9MJNknYgSBUw4oWdyMPJ7ZmPEccdnlgnsXNTnMSMHuUg ibIe293p2pv5KIUr7912ndZp2Gq0oFbG2X5Ij1yFNDiqxTTfoVt0z3I5CGExMCuW uWfoc75cvRV619c74f3ikILOqAnUEWPGVLB65cZiKjpZupt8yJ2cWM1sGfM/Qu4k ge88gtoiw4n0DpadcA2MftPUtzJmM0qlzpkpOg/334xxsTuf6mYeTKv+GgdCGdKV Ko2/Ie5oohkZSV/2cbTtCdj60qyBogO+GNlwAkAseZPs9Cs0v84= =f1bs -----END PGP SIGNATURE-----