CVE-2026-126080: ActiveSupport: regex injection in safe_constantize DoS

### Impact When constant lookup raises `LoadError`, `ActiveSupport::Inflector#safe_constantize` (and `String#safe_constantize`) builds a regular expression from the requested constant name without escaping it, so a caller that passes untrusted input lets the attacker choose the source of a pattern that the application compiles. Crafted patterns can trigger defects in Ruby's regular expression compiler, possibly leading to a crash of the server process, and repeated requests could keep the application unavailable. Action Cable passes the `channel` value of each `subscribe` command to `safe_constantize` before any channel lookup, so in the default configuration an unauthenticated client of the Action Cable endpoint can reach this code. ### Details The check that decides whether `safe_constantize` returns `nil` or re-raises the `LoadError` now matches the first segment of the constant name against the error message as a literal string, and no longer compiles a regular expression. It returns the same result as before for constant names that contain no regular expression syntax. ### Affected applications An application is affected if it meets all of these requirements: - Mounts Action Cable, which a new Rails application does by default at `/cable` (`config.action_cable.mount_path`), or otherwise passes untrusted input to `safe_constantize`. - Accepts Action Cable connections from untrusted clients. `ApplicationCable::Connection#connect` authenticates nobody unless the application adds a check. ### Workarounds Applications that do not use Action Cable can set `config.action_cable.mount_path = nil` to remove the endpoint. Applications that use Action Cable can call `reject_unauthorized_connection` in `ApplicationCable::Connection#connect` for unauthenticated clients, which limits exposure to authenticated users but does not remove it. ### Releases The fixed releases are available at the normal locations. Patches for those who cannot upgrade at once: - 8.1: https://github.com/rails/rails/commit/95aa9e416016524956d4904fed96eaed079580bb.patch - 8.0: https://github.com/rails/rails/commit/210ac22d446c8e2625b091e79256806b836eee20.patch ### Versions affected - activesupport < 8.0.5.2 - activesupport >= 8.1, < 8.1.4.1 ### Credit This issue was responsibly reported by Felix Tscheulin ([flixt](https://hackerone.com/flixt)) through HackerOne researcher [scheja](https://hackerone.com/scheja), and independently by Bucky Wolfe ([Igneous](https://github.com/Igneous)), who provided a proof of concept that crashes the server. It was also found by the Anthropic OSS Scanner (ANT-2026-ZUN5KU3Q).

An attacker finds an internet-facing Rails application that serves an LLM chat or agent dashboard and exposes /cable. Without any authentication, they open a WebSocket connection and send a subscribe command whose channel value contains a crafted regular expression pattern. The server calls safe_constantize, the constant lookup raises LoadError, and the unescaped name is compiled into a regex that triggers a defect in Ruby's regex compiler and crashes the process. The attacker repeats the request in a loop, keeping the AI-facing application down despite automatic restarts.