CVE catalog

CVE-2024-26144

rails: CVE-2024-26144

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.13% · Oct 25, 2026

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrailssid2:7.2.4+dfsg-2fixed
Debianrailsforky2:7.2.4+dfsg-1fixed
Debianrailstrixie2:7.2.2.2+dfsg-2~deb13u1fixed
Debianrailstrixie-security2:7.2.2.2+dfsg-2~deb13u2fixed
Debianrailsbookworm2:6.1.7.10+dfsg-1~deb12u2fixed
Debianrailsbookworm-security2:6.1.7.10+dfsg-1~deb12u3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrailssourcesid2:7.2.2.1+dfsg-1not yet assignedNot reported[1065119]
Debianrailssourceforky2:7.2.2.1+dfsg-1not yet assignedNot reported[1065119]
Debianrailssourcetrixie2:7.2.2.1+dfsg-1not yet assignedNot reported[1065119]
Debianrailssourcebookworm2:6.1.7.10+dfsg-1~deb12u1not yet assignedNot reported[1065119]

[Debian bug #1065119]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]