Don’t Just Upgrade Rails — 6 CVEs Your Rails App Might Have and What to Patch

As Rails continues to evolve, each release not only introduces new features but also addresses security vulnerabilities and enhance the framework. When a version reaches End-of-Life (EOL), it means it will stop receiving security patches. As a result, any known CVEs (Common Vulnerabilities and Exposures) remain unaddressed in applications running those unsupported versions.

In this post, we’ll break down recent Rails-related CVEs, show which versions are still affected what’s the impact and how it can be fixed.

When a Rails version goes EOL, it stops getting fixes — even if new vulnerabilities are found. This means that if you’re still running EOL Rails version, your applications remain exposed to critical issues discovered after support ended.

According to Rails Maintenance Policy opens a new window , currently security fixes may land in 7.2, and 8.0, but they won’t be backported to unsupported versions. Rails 7.1 was the last version to drop security fixes support in October 1st, 2025 and now it’s not supported anymore.

Recent CVEs Dive

Here are some of the most recent vulnerabilities that affect unsupported Rails versions.

Note: not every vulnerability in a Rails app is fixed by upgrading Rails itself. CVEs can target third-party gems or the Ruby standard library bundled with your Ruby runtime. For each CVE bellow it’s listed how to fix it, either upgrading Rails, a gem or Ruby itself.

1. CVE-2025-24293 — Active Storage Unsafe Transformation Methods opens a new window

• Impact: Possibility of remote code execution (RCE) if attackers can pass arbitrary image transformations. An attacker could inject dangerous options.
• Affected Versions: Rails ≥ 5.2.0 up until the fixed versions (7.1.5.2 / 7.2.2.2 / 8.0.2.1).
• Fix: Upgrade Rails to patched versions, which enforce safer defaults and restrict allowed methods. Alternatively, whitelist transformations:

Example:

# ❌ Vulnerable code (user controls transformation args)
variant = user.avatar.variant(params[:transform])

# ✅ Safer approach
ALLOWED_VARIANTS = {
  "thumb" => { resize_to_limit: [100, 100] },
  "medium" => { resize_to_limit: [300, 300] }
}

variant = user.avatar.variant(ALLOWED_VARIANTS[params[:variant]] || {})

2. CVE-2025-55193 — ANSI Escape Injection in Active Record Logging opens a new window

• Impact: Attackers could inject ANSI escape sequences into logs, making them misleading or unreadable.
• Affected Versions: Rails < 7.1.5.2, < 7.2.2.2, < 8.0.2.1.
• Fix: Upgrade to patched versions where logging escapes such sequences.

Example:

# ❌ Malicious input in logs
User.find_by(username: "\e[31mFAKE_ADMIN\e[0m")
# This would render "FAKE_ADMIN" in red inside logs.

3. CVE-2024-26144 — Active Storage Session Leak via Proxy Caching opens a new window

• Impact: In certain proxy setups, Set-Cookie headers from blob-serving endpoints could be cached and exposed.
• Affected Versions: Rails ≥ 5.2.0 before 7.0.8.1 / 6.1.7.7.
• Fix: Upgrade Rails, or adjust caching headers to prevent caching responses with Set-Cookie.

Example:

If a proxy caches responses with cookies, another user may receive someone else’s session cookie — a serious privacy leak.

# Example of adding safe cache headers
response.headers["Cache-Control"] = "private, no-store"

4. CVE-2025-43857 — DoS in net-imap Gem opens a new window

• Impact: Malicious IMAP servers can trigger excessive memory use or crashes in Rails apps using IMAP.
• Affected Versions: net-imap ≤ 0.2.4, 0.3.0–0.3.8, 0.4.0–0.4.19, 0.5.0–0.5.6.
• Fix: Upgrade the net-imap gem to ≥ 0.3.9, 0.4.20, or 0.5.7 depending on your series.

Important: This is a vulnerability in the net-imap gem (a dependency), not in Rails itself. Upgrading Rails will NOT fix this — you must update the net-imap gem (and redeploy).

Example Gemfile change and commands:

# Gemfile
gem "net-imap", ">= 0.5.7"

5. CVE-2025-25186 — DoS in net-imap UID-Set Parsing opens a new window

• Impact: A malicious server can trigger a denial-of-service by sending highly compressed uid-set data which is automatically read by the client’s receiver thread The response parser uses Range#to_a to convert the uid-set data into arrays of integers.
• Affected Versions: net-imap 0.3.2–0.3.7, 0.4.x up to 0.4.18, 0.5.0–0.5.5.
• Fix: Upgrade net-imap to ≥ 0.3.8, 0.4.19, or 0.5.6.

Important: Like previous CVE, this is a vulnerability in the net-imap gem. Upgrading Rails alone will not address it — update the net-imap gem and redeploy.

6. REXML XML Parsing CVEs opens a new window

• Impact: DoS or ReDoS vulnerability when parsing XML containing multiple XML declarations.
• Affected Versions: Older Ruby versions bundling REXML >= 3.3.3, or before 3.4.2 in the latest CVE-2025-58767.
• Fix: Update Ruby and/or the rexml to 3.4.2.

Important: This issue is in the rexml library (part of the Ruby stdlib in some Ruby versions). Upgrading Rails will not necessarily fix it — you must update the rexml gem or the Ruby runtime that bundles a fixed rexml version.

Conclusion

Unsupported Rails versions don’t just miss new features — they’re left exposed to real, documented vulnerabilities. CVEs like the Active Storage RCE, logging injection, or session cookie leaks can have serious consequences in production apps.

The only reliable way to stay safe is to keep your libraries stack updated, You scan it for known vulnerabilities using bundler-audit gem — it will give you a quick list of insecure gems and known CVEs that may affect your application. Run it regularly and treat its findings as high-priority fixes.