CVE-2019-5421: Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in

Q: How do I fix CVE-2019-5421?

devise: upgrade to newer than 4.5.0. Exact commands for each OS are on this page.

Q: Is CVE-2019-5421 being exploited?

CVE-2019-5421 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2019-5421 affect?

CVE-2019-5421 affects devise. Severity is critical (CVSS 9.8). Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specifically at the `#increment_failed_attempts` method. File location: lib/devise/mode

Q: How urgent is CVE-2019-5421?

Priority 63/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action

This week

CRITICAL 9.8REMOTEUPGRADE

CVE-2019-5421 is a critical-severity flaw (CVSS 9.8) affecting devise. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specifically at the `#increment_failed_attempts` method. File location: lib/devise/models/lockable.rb that can result in Multiple concurrent requests can prevent an attacker from being blocked on brute force attacks. This attack appear to be exploitable via Network connectivity - brute force atta

Why this priority

Critical severity
Public exploit reference
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	1.6% (top 25%)
CISA exploited list	No
Weakness	CWE-367, CWE-307
Published	2019-04-03
Last modified	2026-06-17

Publisher (CNA): HackerOne · Vendor: plataformatec

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2019-04-03 15:29 UTCPublished CVE record published
2026-06-17 02:37 UTCUpdated Record last modified

plataformatec devise UPGRADE

Affected: <= 4.5.0

Fixed in: newer than 4.5.0

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy devise || rpm -q devise || devise --version

2. UPGRADE to newer than 4.5.0 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade devise

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade devise

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2019-5421?

devise: upgrade to newer than 4.5.0. Exact commands for each OS are on this page.

Is CVE-2019-5421 being exploited?

CVE-2019-5421 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2019-5421 affect?

CVE-2019-5421 affects devise. Severity is critical (CVSS 9.8). Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specifically at the `#increment_failed_attempts` method. File location: lib/devise/mode

How urgent is CVE-2019-5421?

Priority 63/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action

Related CVEs

CVE-2026-40295 MEDIUM 6.1 UPGRADE Devise is an authentication solution for Rails based on Warden
CVE-2026-32700 MEDIUM 5.3 UPGRADE Devise is an authentication solution for Rails based on Warden
CVE-2019-16109 MEDIUM 5.3 UPGRADE An issue was discovered in Plataformatec Devise before 4.7.1
CVE-2015-8314 HIGH 7.5 UPGRADE The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary

References

← Back to latest CVEs