CVE-2026-126073

Name of the Vulnerable Software and Affected Versions Action Pack versions prior to 8.1.4.1 Action Pack versions prior to 8.0.5.2

Description Action Pack handles response format negotiation using the Accept, X-Requested-With, and Content-Type request headers. The ActionController::Rendering# set vary header function only adds Vary: Accept if the request contains a usable Accept header and no Vary header is already present. Consequently, responses to XHR requests or requests lacking an Accept header may omit the headers that determined their representation. If an application sets a Vary header (e.g., Vary: Accept-Language) before rendering, Accept is never added. This can lead to cache poisoning in shared caches that honor the Vary header, such as Thruster or Rack::Cache, where clients may receive an incorrect representation, such as a page without layout instead of JSON, until the cache entry expires. The attacker cannot control the response content. This affects applications rendering negotiated responses from actions marked as public.

Recommendations Update to version 8.1.4.1. Update to version 8.0.5.2. As a temporary workaround, set Vary: Accept, X-Requested-With on negotiated responses within the application, such as in an after action. As a temporary workaround, avoid marking negotiated responses as public.