AIKIDO-2026-855506

TL;DR

A search key is processed in Ransack::Context#association_path in quadratic time based on how many _ separated segments it has, and Rack has no length limit on a query parameter key, so the segment count comes from untrusted input. Each segment causes a linear length segments.join("_") rebuild plus a regex match, so a key with thousands of segments burns seconds of CPU on a worker. A handful of concurrent requests against any endpoint that calls ransack exhausts the worker pool, leading to unauthenticated denial of service. The fix caps key depth at Constants::MAX_KEY_DEPTH and rejects keys that exceed that depth before parsing begins.