CVE-2026-126080

### Impact When constant lookup raises `LoadError`, `ActiveSupport::Inflector#safe_constantize` (and `String#safe_constantize`) builds a regular expression from the requested constant name without escaping it, so a caller that passes untrusted input lets the attacker choose the source of a pattern that the application compiles. Crafted patterns can trigger defects in Ruby's regular expression compiler, possibly leading to a crash of the server process, and repeated requests could keep the application unavailable. Action Cable passes the `channel` value of each `subscribe` command to `safe_constantize` before any channel lookup, so in the default configuration an unauthenticated client of the Action Cable endpoint can reach this code. ### Details The check that decides whether `safe_constantize` returns `nil` or re-raises the `LoadError` now matches the first segment of the constant name against the error message as a literal string, and no longer compiles a regular expression. It returns the same result as before for constant names that contain no regular expression syntax. ### Affected applications An application is affected if it meets all of these requirements: - Mounts Action Cable, which a new Rails application does by default at `/cable` (`config.action_cable.mount_path`), or otherwise passes untrusted input to `safe_constantize`. - Accepts Action Cable connections from untrusted clients. `ApplicationCable::Connection#connect` authenticates nobody unless the application adds a check. ### Workarounds Applications that do not use Action Cable can set `config.action_cable.mount_path = nil` to remove the endpoint. Applications that use Action Cable can call `reject_unauthorized_connection` in `ApplicationCable::Connection#connect` for unauthenticated clients, which limits exposure to authenticated users but does not remove it. ### Releases The fixed releases are available at the normal locations. Patches for those who cannot upgrade at once: - 8.1: https://g