Security update: CVE-2026-126080

We’ve deployed a security update to mitigate CVE-2026-126080, a vulnerability in ActiveSupport, part of the Rails framework used by Sorry. The issue could allow specially crafted requests to disrupt service.

Following the Rails team’s recommended mitigation, we’ve disabled an unused framework endpoint that exposed the affected code.

No action is needed from customers.