CVE-2026-126072: Anthropic Python Live buffer

Q: Is CVE-2026-126072 actively exploited?

No confirmed active exploitation of CVE-2026-126072 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-126072?

1) Upgrade actionpack to 8.1.4.1 or later (8.0.5.2 for the 8.0 branch). 2) If you cannot upgrade immediately, apply the upstream patches (commits ccbfc096 for 8.1 and 27ad18ed for 8.0). 3) Set aggressive write and idle timeouts at the reverse proxy or load balancer (nginx, Caddy, ALB) so stalled clients are dropped. 4) Rate-limit and cap concurrent connections per client IP on streaming and Active Storage proxy endpoints. 5) Consider redirect mode instead of proxy mode for Active Storage downloads. 6) Monitor for thread pool saturation, growing counts of busy Puma threads, and long-lived streaming connections with no read progress.

Q: What systems are affected by CVE-2026-126072?

This vulnerability affects the following AI/ML architecture patterns: Streaming LLM chat backends, Model serving web frontends, Web applications serving large AI artifacts.

Q: What is the CVSS score for CVE-2026-126072?

CVE-2026-126072 has a CVSS v3.1 base score of 5.9 (MEDIUM). The EPSS exploitation probability is 0.41%.

CISO Take

A deadlock in Rails' ActionController::Live (including send_stream) lets a client that stops reading a streamed response permanently pin a web server thread, so repeated slow or abandoned requests can exhaust the thread pool and take the application offline. This is a general web framework flaw rather than an AI-specific one, but it affects any AI service built on Rails that streams output, such as LLM chat or token-streaming endpoints. Risk is moderate: CVSS is 5.9 with high attack complexity, EPSS is low (0.41%, top 64th percentile), it is not in CISA KEV, and no public exploit or Nuclei template exists. Blast radius is wide, though, with about 6,440 downstream dependents and unauthenticated exposure where Active Storage proxy mode serves large files. Upgrade actionpack to 8.1.4.1 (or 8.0.5.2 on the 8.0 line) and, until then, apply the vendor patches and enforce connection and request timeouts at the reverse proxy.

Sources:NVDGitHub AdvisoryEPSSATLAS

What is the risk?

Medium. The attack is network-reachable, needs no privileges or user interaction, and affects availability only (CVSS 5.9, A:H). High complexity comes from needing to hold connections open with a stalled client at scale. EPSS is low, no public exploit is known, and it is not in KEV. Exposure is highest for internet-facing Rails apps that stream responses, especially LLM token streaming and Active Storage proxy downloads, which are reachable without authentication.

How does the attack unfold?

Initial Access

Attacker sends requests to a public streaming endpoint or Active Storage proxy download without needing authentication.

AML.T0049

Exploitation

Client stops reading so the bounded response queue fills and Buffer#close blocks while holding the monitor, deadlocking Buffer#abort.

Impact

Stalled responses permanently hold server and Live threads, exhausting the pool and denying service to legitimate users.

AML.T0029

Initial Access

Attacker sends requests to a public streaming endpoint or Active Storage proxy download without needing authentication.

AML.T0049

Exploitation

Client stops reading so the bounded response queue fills and Buffer#close blocks while holding the monitor, deadlocking Buffer#abort.

Impact

Stalled responses permanently hold server and Live threads, exhausting the pool and denying service to legitimate users.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Anthropic Python	rubygems	>= 8.1.0.beta1, < 8.1.4.1	`8.1.4.1`
4.1K6.4K dependentsPushed 8d ago94% patched~11d to patchFull package profile →

Do you use Anthropic Python? You're affected.

How severe is it?

CVSS 3.1

5.9 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 36% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade actionpack to 8.1.4.1 or later (8.0.5.2 for the 8.0 branch). 2) If you cannot upgrade immediately, apply the upstream patches (commits ccbfc096 for 8.1 and 27ad18ed for 8.0). 3) Set aggressive write and idle timeouts at the reverse proxy or load balancer (nginx, Caddy, ALB) so stalled clients are dropped. 4) Rate-limit and cap concurrent connections per client IP on streaming and Active Storage proxy endpoints. 5) Consider redirect mode instead of proxy mode for Active Storage downloads. 6) Monitor for thread pool saturation, growing counts of busy Puma threads, and long-lived streaming connections with no read progress.

How is it classified?

DoSFrameworkAPIAML.T0029- Denial of AI Service AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to unknown risks and incident handling

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-126072?

A deadlock in Rails' ActionController::Live (including send_stream) lets a client that stops reading a streamed response permanently pin a web server thread, so repeated slow or abandoned requests can exhaust the thread pool and take the application offline. This is a general web framework flaw rather than an AI-specific one, but it affects any AI service built on Rails that streams output, such as LLM chat or token-streaming endpoints. Risk is moderate: CVSS is 5.9 with high attack complexity, EPSS is low (0.41%, top 64th percentile), it is not in CISA KEV, and no public exploit or Nuclei template exists. Blast radius is wide, though, with about 6,440 downstream dependents and unauthenticated exposure where Active Storage proxy mode serves large files. Upgrade actionpack to 8.1.4.1 (or 8.0.5.2 on the 8.0 line) and, until then, apply the vendor patches and enforce connection and request timeouts at the reverse proxy.

Is CVE-2026-126072 actively exploited?

No confirmed active exploitation of CVE-2026-126072 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-126072?

1) Upgrade actionpack to 8.1.4.1 or later (8.0.5.2 for the 8.0 branch). 2) If you cannot upgrade immediately, apply the upstream patches (commits ccbfc096 for 8.1 and 27ad18ed for 8.0). 3) Set aggressive write and idle timeouts at the reverse proxy or load balancer (nginx, Caddy, ALB) so stalled clients are dropped. 4) Rate-limit and cap concurrent connections per client IP on streaming and Active Storage proxy endpoints. 5) Consider redirect mode instead of proxy mode for Active Storage downloads. 6) Monitor for thread pool saturation, growing counts of busy Puma threads, and long-lived streaming connections with no read progress.

What systems are affected by CVE-2026-126072?

This vulnerability affects the following AI/ML architecture patterns: Streaming LLM chat backends, Model serving web frontends, Web applications serving large AI artifacts.

What is the CVSS score for CVE-2026-126072?

CVE-2026-126072 has a CVSS v3.1 base score of 5.9 (MEDIUM). The EPSS exploitation probability is 0.41%.

What is the AI security impact?

Affected AI Architectures

Streaming LLM chat backendsModel serving web frontendsWeb applications serving large AI artifacts

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

### Impact `ActionController::Live::Buffer#close` pushes its end-of-stream marker onto the response's bounded queue while it holds the buffer's monitor. When the client has stopped reading and the queue is full, the push blocks, and `Buffer#abort`, which runs when the client disconnects or a write times out, waits indefinitely for the same monitor. Each such response could permanently hold a web server thread and its `ActionController::Live` thread, possibly resulting in a DoS vulnerability through thread exhaustion. Applications that stream responses with `ActionController::Live`, including `send_stream`, are affected. Applications that serve large files through Active Storage proxy mode are exposed to unauthenticated clients. ### Releases The fixed releases are available at the normal locations. Patches for those who cannot upgrade at once: - 8.1: https://github.com/rails/rails/commit/ccbfc09690fef05fdd2a9969c917a71b92cc98fc.patch - 8.0: https://github.com/rails/rails/commit/27ad18ed5900dee28ba20e9c6fc718ff751fa215.patch ### Credit This issue was found by the Anthropic OSS Scanner (ANT-2026-LDFW5N2T).

Exploitation Scenario

An attacker finds a Rails-based AI chat product that streams LLM responses via ActionController::Live, or a model hosting site that serves large files through Active Storage proxy mode. They open many requests to large or streaming endpoints, read a small amount of data, then stop reading while keeping or dropping the connection so the bounded queue fills. Each response deadlocks in Buffer#close and Buffer#abort, permanently holding its threads. After a number of such requests equal to the thread pool size, the application stops serving legitimate users until it is restarted.

Weaknesses (CWE)

CWE-833DeadlockPrimary

CWE-833 — Deadlock: The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.

Source: MITRE CWE corpus.