Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.9 | Medium | 3.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.010, the 63rd percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 15:16 UTC First seen by agentprime
- 31 Oct 2026, 15:16 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-m875-3xf6-mf78
- OSV: GHSA-m875-3xf6-mf78
- github.com/unpoly/unpoly-rails/security/advisories/GHSA-m875-3xf6-mf78
- nvd.nist.gov/vuln/detail/CVE-2023-28846
- github.com/unpoly/unpoly-rails/commit/cd9ad0007daceeb3b2354fdcab4f88350427bf16
- docs.nginx.com/nginx/admin-guide/load-balancer/http-health-check/#passive-health-checks
- github.com/rubysec/ruby-advisory-db/blob/master/gems/unpoly-rails/CVE-2023-28846.yml
- github.com/unpoly/unpoly-rails
- makandracards.com/operations/537537-nginx-proxy-buffer-tuning
- tryhexadecimal.com/guides/http/414-request-uri-too-long
- unpoly.com/up.protocol