DEBIAN-CVE-2026-126085

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-126085
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-126085.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-126085
Upstream
Published
2026-11-10T22:18:31Z
Modified
2026-11-11T10:00:56Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSService#url_for_direct_upload does not bind the declared content length into the signed direct-upload URL, and #headers_for_direct_upload returns no length constraint, so the URL authorizes an upload body of any size. A direct-upload client could store a file larger than the byte_size it declared, and the resulting blob keeps the declared size, possibly bypassing application file size validations and quotas. This is the weakness that CVE-2020-8162 fixed in the S3 service. Applications that store files in Google Cloud Storage and accept direct uploads are affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

References

Affected packages

Debian:12 / rails

Package

Name
rails
Purl
pkg:deb/debian/rails?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2:6.*
2:6.1.7.3+dfsg-1
2:6.1.7.3+dfsg-2~deb12u1
2:6.1.7.3+dfsg-2
2:6.1.7.3+dfsg-3
2:6.1.7.3+dfsg-4
2:6.1.7.3+dfsg-5
2:6.1.7.3+dfsg-6
2:6.1.7.3+dfsg-7~exp1
2:6.1.7.3+dfsg-7
2:6.1.7.3+dfsg-8
2:6.1.7.3+dfsg-9
2:6.1.7.3+dfsg-10
2:6.1.7.3+dfsg-11
2:6.1.7.3+dfsg-12
2:6.1.7.3+dfsg-13
2:6.1.7.10+dfsg-1~deb12u1
2:6.1.7.10+dfsg-1~deb12u2
2:6.1.7.10+dfsg-1~deb12u3
2:7.*
2:7.2.2.1+dfsg-1~exp1
2:7.2.2.1+dfsg-1~exp2
2:7.2.2.1+dfsg-1~exp3
2:7.2.2.1+dfsg-1~exp4
2:7.2.2.1+dfsg-1~exp6
2:7.2.2.1+dfsg-1
2:7.2.2.1+dfsg-2
2:7.2.2.1+dfsg-3
2:7.2.2.1+dfsg-4
2:7.2.2.1+dfsg-5
2:7.2.2.1+dfsg-6
2:7.2.2.1+dfsg-7
2:7.2.2.2+dfsg-1
2:7.2.2.2+dfsg-2~deb13u1
2:7.2.2.2+dfsg-2~deb13u2
2:7.2.2.2+dfsg-2
2:7.2.3+dfsg-1
2:7.2.3+dfsg-2
2:7.2.3+dfsg-3
2:7.2.3.1+dfsg-1
2:7.2.3.2+dfsg-1
2:7.2.3.2+dfsg-2
2:7.2.3.2+dfsg-3
2:7.2.4+dfsg-1
2:7.2.4+dfsg-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-126085.json"

Debian:13 / rails

Package

Name
rails
Purl
pkg:deb/debian/rails?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2:7.*
2:7.2.2.1+dfsg-7
2:7.2.2.2+dfsg-1
2:7.2.2.2+dfsg-2~deb13u1
2:7.2.2.2+dfsg-2~deb13u2
2:7.2.2.2+dfsg-2
2:7.2.3+dfsg-1
2:7.2.3+dfsg-2
2:7.2.3+dfsg-3
2:7.2.3.1+dfsg-1
2:7.2.3.2+dfsg-1
2:7.2.3.2+dfsg-2
2:7.2.3.2+dfsg-3
2:7.2.4+dfsg-1
2:7.2.4+dfsg-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-126085.json"

Debian:14 / rails

Package

Name
rails
Purl
pkg:deb/debian/rails?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2:7.*
2:7.2.2.1+dfsg-7
2:7.2.2.2+dfsg-1
2:7.2.2.2+dfsg-2~deb13u1
2:7.2.2.2+dfsg-2~deb13u2
2:7.2.2.2+dfsg-2
2:7.2.3+dfsg-1
2:7.2.3+dfsg-2
2:7.2.3+dfsg-3
2:7.2.3.1+dfsg-1
2:7.2.3.2+dfsg-1
2:7.2.3.2+dfsg-2
2:7.2.3.2+dfsg-3
2:7.2.4+dfsg-1
2:7.2.4+dfsg-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-126085.json"