There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html
https://access.redhat.com/errata/RHSA-2019:0796
https://access.redhat.com/errata/RHSA-2019:1147
https://access.redhat.com/errata/RHSA-2019:1149
https://access.redhat.com/errata/RHSA-2019:1289
https://groups.google.com/forum/#%21topic/rubyonrails-security/GN7w9fFAQeI
https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html