onyx --cves cve-2021-22880
CVE-2021-22880
- score
- <0.1
- cvss
- 7.5
- epss
- 4.4%
- published
- 2021-02-11
- kev added
- —
- first seen
Active Record PostgreSQL adapter before 6.1.2.1, 6.0.3.5, 5.2.4.5 contains a regular expression denial of service caused by vulnerable input validation in the `money` type, letting attackers cause denial of service, exploit requires crafted input.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC
Exploit availability
Public PoC flagged by vulnx; no direct exploit link among the citations.
Weaknesses
References 6
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO5OJ3F4ZL3UXVLJO6ECANRVZBNRS2IH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3/
- https://discuss.rubyonrails.org/t/cve-2021-22880-possible-dos-vulnerability-in-active-record-postgresql-adapter/77129
- https://hackerone.com/reports/1023899
- https://security.netapp.com/advisory/ntap-20210805-0009/
- https://www.debian.org/security/2021/dsa-4929