CVE-2026-33658 json
Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
published 2026-03-23 7 mo ago modified 2026-09-10 59 d ago also EUVD-2026-16426 , GHSA-p9fm-f462-ggrg
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Patch / fix
- rubygems activestorage 7.2.3.1, 8.0.4.1, 8.1.2.1
- rubyonrails activestorage 7.2.3.1, 8.0.4.1, 8.1.2.1
- rails Debian 13 2:7.2.2.2+dfsg-2~deb13u2
- rails Debian 14 2:7.2.3.1+dfsg-1
debian advisories DEBIAN-CVE-2026-33658
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-33658 updated cvss 7.5
rails: activestorage: Active Storage: Denial of Service via HTTP Range header processing
-
Red Hat Satellite 6 rubygem-activestoragenot affected: vulnerable code not in execute path
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | activestorage | >=8.1.0, <8.1.2.1 >=8.0.0, <8.0.4.1 <7.2.3.1 |
8.1.2.1 8.0.4.1 7.2.3.1 |
Affected products
- rails activestorage
Classification
- Weakness
-
- CWE-770 Allocation of Resources Without Limits or Throttling
- Technology feeds
References
-
github.com
/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg
web, vendor-advisory, advisory
-
github.com
/rails/rails/releases/tag/v7.2.3.1
web, product, release-notes
-
github.com
/rails/rails/releases/tag/v8.0.4.1
web, product, release-notes
-
github.com
/rails/rails/releases/tag/v8.1.2.1
web, product, release-notes
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33658.yml
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-33658
advisory
-
github.com
/rails/rails
package
Sources
- CVE List CVE-2026-33658
- GitHub Advisory GHSA-p9fm-f462-ggrg
- NVD CVE-2026-33658
- Maintainer advisory GHSA-p9fm-f462-ggrg
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of rails/rails published their own advisory on GitHub. Reviewed sources take precedence over it.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.