CVE-2021-22904

CVE-2021-22904 is a denial-of-service vulnerability affecting the Action Pack Ruby gem in Ruby on Rails versions prior to 6.1.3.2, 6.0.3.7, 5.2.4.6, and 5.2.6. This flaw stems from an overly permissive regular expression used in the Token Authentication logic, specifically when applications utilize authenticate_or_request_with_http_token or authenticate_with_http_token. With a CVSS score of 7.5 (High), this vulnerability can be exploited remotely with low attack complexity, leading to a complete denial of service without requiring user interaction or privileges. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.