A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user

Summary

A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.

Timeline

1. Jun 19, 2020, 5:05 PM UTCCVE published
2. May 9, 2025, 8:03 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a https://github.com/rails/rails

  Version range not reported

• activesupportRubyGems

  From 5.0.0 · fixed in 5.2.4.3

• activesupportRubyGems

  From 6.0.0 · fixed in 6.0.3.1

References 15