AIKIDO-2026-183245

TL;DR

Ransack's collapse_multiparameter_attributes! method in lib/ransack/search.rb assigns a user supplied multiparameter position value directly as an array index without validating its size. A crafted query key such as q[created_at(100000000000i)]=1 makes Ruby allocate an array of that size, consuming multiple gigabytes of RAM and crashing the worker process. Any endpoint that calls ransack on request parameters is reachable this way, giving an unauthenticated memory exhaustion denial of service from a single request. The fix validates the position index and rejects out of range values before allocation.